mall4j Cart Authorization Flaws via Operator Precedence

Authenticated shoppers on mall4j through version 4.0 can read other customers' off-shelf cart entries - product, SKU, quantity, shop and promoter card numbers - by calling GET /p/shopCart/expiryProdList on the storefront API. Exploitation is medium severity (CVSS 4.0 base 5.3, confidentiality-only): it requires only a self-registered low-privileged account, no administrative rights, no user interaction and no non-default configuration, because the flaw sits in the default getShopCartExpiryItems SQL logic. Publicly available exploit code exists; no confirmed active exploitation has been reported and no vendor-released patch has been identified at time of analysis.

Mall4j through version 4.0 allows any authenticated storefront customer to delete other shoppers' cart entries for off-shelf products by sending a single DELETE request to the /p/shopCart/cleanExpiryProdList endpoint, exploiting an operator precedence error in the cleanExpiryProdList SQL statement that fails to scope the deletion to the caller. This improper authorization flaw (CWE-783) has a CVSS 4.0 score of 5.3 with low integrity and availability impact and no confidentiality impact (PR:L), and publicly available exploit code exists. It is not listed in CISA KEV, and no active exploitation has been confirmed.