macrozheng mall CVE-2025-8191

Exploitation requires: (1) valid authentication credentials to the mall application (PR:L per CVSS vector), (2) the victim must be logged into an active session when visiting the malicious URL, (3) the victim must click or be redirected to the crafted Swagger UI URL with the malicious configUrl parameter, (4) the Swagger UI component must be enabled and accessible (non-default but common in development/staging deployments), and (5) the browser must execute JavaScript (default for all modern browsers). Exploitation does NOT require network admin privileges, does not work against unauthenticated users, and is limited to the integrity domain (not confidentiality or availability). Organizations with Swagger UI disabled on internet-facing instances, or those restricting access to internal networks only, are protected from remote attack chains.

Despite the low CVSS v4.0 score of 2.0, several factors suggest moderate real-world risk. The attack requires authentication (PR:L) and user interaction (UI:P), which significantly restricts attack surface-this is reflected in the low CVSS score and 0.51% EPSS (67th percentile), placing it in a moderate-risk zone rather than critical. However, publicly available exploit code exists, lowering the barrier to exploitation for attackers with valid credentials. The integrity impact (VI:L) suggests session hijacking or credential theft is possible. The vendor's unresponsiveness and deletion of the GitHub issue without explanation raises concerns about long-term supportability. For organizations using macrozheng mall, the real risk depends on whether internal users or external parties can obtain authentication credentials and whether the Swagger UI endpoint is internet-accessible. The EPSS score of 0.51% indicates this is not a mass-exploitation priority, but targeted attacks against specific deployments are feasible.

An attacker with valid credentials to the macrozheng mall application crafts a malicious URL containing a JavaScript payload in the configUrl parameter and sends it to a logged-in administrator via email or chat. When the administrator clicks the link and accesses the Swagger UI page, the injected script executes with the victim's privileges, potentially stealing session cookies, capturing API keys, or performing unauthorized administrative actions on the mall platform.