macrozheng mall EUVD-2026-65486

Exploitation requires a valid authenticated session on the target macrozheng mall instance (PR:L in the CVSS 4.0 vector - a registered user account is the minimum prerequisite). The vulnerable code path is specifically the cart quantity update function (OmsCartItemServiceImpl.updateQuantity) triggered via POST to /cart/update/quantity; the shopping cart feature must be active and accessible to the authenticated user. No special configuration, elevated privileges, or non-default deployment mode is required beyond user-level authentication. Exploitation is limited by the authentication requirement - unauthenticated access to the endpoint is not supported by the CVSS vector. The integrity impact is constrained to the vulnerable system's cart/order data (SC:N/SI:N/SA:N), with no lateral scope change.

The CVSS 4.0 base score of 5.3 (Medium) reflects a constrained impact: integrity is assessed as Low (VI:L) with no confidentiality or availability impact, meaning exploitation does not expose sensitive data or cause service disruption - it corrupts business logic state. The PR:L requirement limits exposure to authenticated users, reducing the realistic attacker population to registered accounts on affected storefronts. No EPSS data was provided in the source intelligence, and the CVE is not listed in CISA KEV, indicating no confirmed active exploitation. No public proof-of-concept code has been identified. The primary real-world concern is financial fraud - an attacker with a valid account could manipulate cart quantities to alter transaction values. The vendor's unexplained deletion of GitHub issue #984 is a red flag for patch availability: organizations deploying this software in any revenue-generating context, even a small internal storefront team, should treat the absence of a vendor response as requiring independent compensating controls rather than waiting for an upstream fix.

An attacker registers or compromises a legitimate user account on a mall instance, then sends a crafted POST request to /cart/update/quantity with a negative or zero quantity value for an item in their cart. If the backend accepts the value without validation, the cart total may be calculated incorrectly - potentially allowing the attacker to place an order at a fraudulent price or zero cost. No public proof-of-concept has been identified, but the attack requires only basic HTTP manipulation skills given the straightforward nature of the parameter tampering.