macrozheng mall Authentication and Logic Flaws

Payment-amount tampering in macrozheng mall through version 1.0.3 lets a customer-side attacker override the amount submitted to Alipay: the portal's payment endpoint passes the client-supplied total_amount straight into the Alipay bizContent instead of the order's stored payAmount, so an attacker with a valid order can alter what is charged or recorded. Exploitation requires a live Alipay integration and an authenticated customer account holding a legitimate outTradeNo, and impact is confined to order/payment integrity rather than code execution or data exposure (assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N). Public exploit code and the upstream fix commit are both available, but there is no indication the flaw is being actively exploited (not in CISA KEV).

Insufficient session expiration in MacroZheng Mall through 1.0.3 allows an attacker who already holds a valid low-privilege JWT for a disabled or deactivated account to keep that session alive by repeatedly calling the /admin/refreshToken endpoint, because JwtTokenUtil.validateToken verified only the username match and token non-expiry and omitted the userDetails.isEnabled() check. The issue is rated 5.3 (CVSS 4.0 vector with PR:L, E:P) with low confidentiality, integrity and availability impact and no scope change, and publicly available exploit code exists, although there is no confirmation of active exploitation. Effectively, the defect prevents account deactivation from taking effect on the token-refresh path, letting a terminated user retain access until the token is otherwise invalidated.