Youlai Mall CVE-2025-15087

No vendor-released patch identified at time of analysis. The vendor was contacted early but provided no response. Immediate remediation requires implementing server-side authorization validation in the submitOrderPayment function to ensure the authenticated user owns the order identified by the orderSn parameter before processing payment submission. Implement this check by verifying the userId associated with the provided orderSn matches the authenticated user's ID before executing the payment logic. As a compensating control pending a vendor patch, restrict access to the submitOrderPayment endpoint to authenticated users only (already enforced), log all payment submission attempts including orderSn values for audit purposes, and monitor for suspicious patterns of users submitting payments for multiple distinct orderSn values within short timeframes. Consider temporarily disabling payment submission through this endpoint if order ownership cannot be verified, routing payments through an alternative secure payment flow. Organizations using Youlai Mall 1.0.0 or 2.0.0 should contact the vendor directly to request patched versions or consider migrating to alternative e-commerce platforms with active security maintenance.