EUVD-2026-98551
GHSA-x94q-f3xj-x9m2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to mall-portal storefront
-
ExploitCraft /order/generateOrder request with tampered coupon_amount/pay_amount
-
ExecutionBypass weak server-side price validation
-
ImpactComplete order at manipulated price
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V2 - Validation and Business Logic Business logic errors
|
| Exploitation Conditions | Requires a valid authenticated user account (PR:L) on the mall-portal storefront that can reach the /order/generateOrder endpoint; the attacker then tampers with the coupon_amount or pay_amount parameters during order creation to trigger business-logic errors in OmsPortalOrderServiceImpl. Applies to macrozheng mall up to version 1.0.3. Limiting factors: exploitation needs an authenticated session (not anonymous), and real-world exposure is constrained by the product's small production footprint; no special non-default configuration or user interaction is required beyond normal order submission. |
| Impact | This is a moderate-severity business-logic flaw (CWE-840), not an urgent priority. The CVSS 4.0 base score of 5.3 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L) indicates remote but authenticated exploitation (PR:L) with only low integrity/availability impact and no confidentiality impact. No EPSS score, CISA KEV listing, or public POC was provided in the input, so exploitation status is 'no public exploit identified at time of analysis.' The only intelligence source is VulDB; there is no vendor advisory because the vendor deleted the GitHub issue without explanation, which weakens confirmation and leaves affected-version boundaries dependent on a single reporter. Notably, the 'Information Disclosure' tag conflicts with the CVSS vector (VC:N, no confidentiality impact) and with CWE-840 - this appears to be a mislabeling, as the actual issue is manipulation of order/payment amounts (an integrity concern), not data exposure. Overall: a real but low-urgency financial/integrity bug requiring an authenticated storefront account, relevant chiefly to anyone actually running this specific open-source project. |
| Exploit ScenarioDerived | An attacker who registers a normal customer account on a deployed macrozheng mall storefront submits a crafted order through /order/generateOrder with tampered coupon_amount or pay_amount values, causing the server to accept an order at an incorrect (e.g., reduced or zero) price. Because exploitation is network-reachable and low-complexity but requires a valid authenticated session, the practical impact is financial manipulation of orders rather than system compromise. No public exploit code was identified at the time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Business-logic manipulation in the MacroZheng mall e-commerce platform (mall-portal component) up to version 1.0.3 allows an authenticated storefront user to tamper with the coupon_amount and pay_amount parameters submitted to the /order/generateOrder endpoint, causing the OmsPortalOrderServiceImpl order-generation logic to compute incorrect order totals and payment records. The issue is a CWE-840 business-logic weakness rated 5.3 (CVSS 4.0) by the reporter; the assessed impact is limited to integrity (no confidentiality or availability effect), and exploitation requires a valid authenticated account plus the ability to submit an order - so it is a moderate-priority flaw rather than an urgent one. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no vendor patch was published; notably, the vendor deleted the associated GitHub issue without explanation, which reduces the information available to defenders.
RemediationAI
No vendor-released patch identified at time of analysis - the vendor removed the related GitHub issue (https://github.com/macrozheng/mall/issues/1002) without publishing a fix or fixed version, so the primary remediation is code-level correction rather than an upgrade. The effective fix is to stop trusting client-supplied coupon_amount and pay_amount in OmsPortalOrderServiceImpl: recompute the payable amount server-side from the persisted cart, SKU prices, and the coupon definition, then validate that the submitted values match the recomputed totals before persisting the order. Additionally, enforce coupon ownership/eligibility and single-use constraints at order creation, and reject any request whose amounts deviate from server-calculated values (trade-off: orders relying on legitimate promotional or manual pricing rules need those rules migrated into the server-side calculator first, otherwise valid orders may be rejected). As compensating controls, restrict network access to the mall-portal /order/generateOrder endpoint to trusted users/networks, add server-side rate limiting and anomaly alerting on order amounts, and reconcile orders against payment records to detect mismatches (trade-off: limiting endpoint reachability degrades the customer-facing storefront experience, and reconciliation is detective, not preventive). Monitor https://vuldb.com/vuln/416948 and the upstream repository at https://github.com/macrozheng/mall/ for a patched release, and apply it as soon as one is published.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
MacroZheng mall is a Java/Spring Boot-based open-source e-commerce reference platform whose storefront functionality lives in the mall-portal module; OmsPortalOrderServiceImpl implements the order-creation workflow reached through /order/generateOrder. The flaw falls into CWE-840 (Business Logic Errors): the service accepts client-supplied pricing inputs - specifically coupon_amount and pay_amount - and uses them in the order/payment calculation instead of re-deriving those values server-side from authoritative data such as the coupon record, product catalog price, and cart contents. Because the parameters are attacker-controllable within a legitimate request, a user can influence the resulting order amount and the corresponding payment expectation, producing inconsistent records between orders, coupons, and payment state. The CPE cpe:2.3:a:macrozheng:mall:*:*:*:*:*:*:*:* indicates the advisory maps to the mall product generally, while the description scopes affected code to releases up to 1.0.3. There is no memory-safety or injection primitive here; the exposure is an authorization/validation gap in server-side trust of request data.
Know when Mall gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Authenticated storefront account needed to place an order (PR:L), network-reachable and low-complexity; price/amount tampering is a low integrity impact with no confidentiality or availability effect.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
DescriptionCVE.org
A weakness has been identified in macrozheng mall up to 1.0.3. This vulnerability affects the function OmsPortalOrderServiceImpl of the file /order/generateOrder of the component mall-portal. This manipulation of the argument coupon_amount/pay_amount causes business logic errors. The attack is possible to be carried out remotely. The vendor deleted the GitHub issue for this vulnerability without any explanation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Payment-amount tampering in macrozheng mall through version 1.0.3 lets a customer-side attacker override the amount subm
macrozheng mall e-commerce platform v1.0.3 has an authentication vulnerability in password reset enabling unauthorized a
Weak password recovery in macrozheng mall (commit 0504e86) exposes the /sso/getAuthCode endpoint of the mall-portal modu
A vulnerability classified as critical was found in Weitong Mall 1.0.0. Rated medium severity (CVSS 6.9), this vulnerabi
A vulnerability classified as critical has been found in Weitong Mall 1.0.0. Rated medium severity (CVSS 6.9), this vuln
A vulnerability was found in macrozheng mall up to 1.0.3. Rated medium severity (CVSS 6.3), this vulnerability is remote
Insufficient session expiration in MacroZheng Mall through 1.0.3 allows an attacker who already holds a valid low-privil
A security flaw has been discovered in macrozheng mall-swarm and mall up to 1.0.3. Rated medium severity (CVSS 5.3), thi
A vulnerability was detected in macrozheng mall-swarm and mall up to 1.0.3. Rated medium severity (CVSS 5.3), this vulne
A security vulnerability has been detected in macrozheng mall-swarm and mall up to 1.0.3. Rated medium severity (CVSS 5.
A weakness has been identified in macrozheng mall-swarm and mall up to 1.0.3. Rated medium severity (CVSS 5.3), this vul
Improper authorization in macrozheng mall up to version 1.0.3 allows authenticated remote attackers to modify member add
Exploit-DB