Mall
Monthly
macrozheng mall e-commerce platform v1.0.3 has an authentication vulnerability in password reset enabling unauthorized account takeover.
Incorrect order money calculations in macrozheng mall 1.0.3 (commit dcaa93b) let a backend administrator manipulate the values processed by OmsOrderServiceImpl.updateMoneyInfo through the privileged /order/update/moneyInfo endpoint, producing deliberately wrong order totals. Exploitation requires an authenticated mall-admin session with administrative privileges (CVSS PR:H) plus operator interaction with the order-editing workflow (UI:P), so there is no anonymous or unauthenticated path; impact is confined to integrity of order money fields, with no data disclosure and no availability loss. No public exploit code has been identified at time of analysis and no EPSS scoring was supplied, and the vendor deleted the associated GitHub issue (#1004) without explanation, leaving no official patch guidance.
Business-logic manipulation in the MacroZheng mall e-commerce platform (mall-portal component) up to version 1.0.3 allows an authenticated storefront user to tamper with the coupon_amount and pay_amount parameters submitted to the /order/generateOrder endpoint, causing the OmsPortalOrderServiceImpl order-generation logic to compute incorrect order totals and payment records. The issue is a CWE-840 business-logic weakness rated 5.3 (CVSS 4.0) by the reporter; the assessed impact is limited to integrity (no confidentiality or availability effect), and exploitation requires a valid authenticated account plus the ability to submit an order - so it is a moderate-priority flaw rather than an urgent one. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no vendor patch was published; notably, the vendor deleted the associated GitHub issue without explanation, which reduces the information available to defenders.
Insufficient session expiration in MacroZheng Mall through 1.0.3 allows an attacker who already holds a valid low-privilege JWT for a disabled or deactivated account to keep that session alive by repeatedly calling the /admin/refreshToken endpoint, because JwtTokenUtil.validateToken verified only the username match and token non-expiry and omitted the userDetails.isEnabled() check. The issue is rated 5.3 (CVSS 4.0 vector with PR:L, E:P) with low confidentiality, integrity and availability impact and no scope change, and publicly available exploit code exists, although there is no confirmation of active exploitation. Effectively, the defect prevents account deactivation from taking effect on the token-refresh path, letting a terminated user retain access until the token is otherwise invalidated.
Payment-amount tampering in macrozheng mall through version 1.0.3 lets a customer-side attacker override the amount submitted to Alipay: the portal's payment endpoint passes the client-supplied total_amount straight into the Alipay bizContent instead of the order's stored payAmount, so an attacker with a valid order can alter what is charged or recorded. Exploitation requires a live Alipay integration and an authenticated customer account holding a legitimate outTradeNo, and impact is confined to order/payment integrity rather than code execution or data exposure (assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N). Public exploit code and the upstream fix commit are both available, but there is no indication the flaw is being actively exploited (not in CISA KEV).
Payment status workflow bypass in macrozheng mall up to version 1.0.3 allows authenticated remote attackers to manipulate the orderId parameter at the /order/paySuccess endpoint, potentially marking arbitrary orders as paid without completing actual payment. This CWE-841 business logic flaw directly threatens e-commerce transaction integrity - a proof-of-concept exists (CVSS 4.0 E:P), though no active exploitation is confirmed in CISA KEV. Notably, the vendor silently deleted the GitHub disclosure issue without providing any remediation, leaving no patch available at time of analysis.
Weak password recovery in macrozheng mall (commit 0504e86) exposes the /sso/getAuthCode endpoint of the mall-portal module to remote manipulation, enabling account takeover via a broken authentication flow. The flaw maps to CWE-640 and requires no authentication, though exploitation is rated high complexity. A publicly available exploit has been published; the vendor deleted the corresponding GitHub issue without explanation and has not responded to private disclosure.
Resource identifier manipulation in macrozheng mall up to 1.0.3 allows authenticated remote attackers to access or affect return-application records belonging to other users by substituting arbitrary orderId values in POST requests to /returnApply/create. The flaw is classified as CWE-99 (Improper Control of Resource Identifiers), consistent with an Insecure Direct Object Reference (IDOR) pattern in the Portal Endpoint. A public exploit is available, and the vendor deleted the corresponding GitHub issue without comment, raising concerns about coordinated disclosure and patch status.
Improper authorization (CWE-285) in macrozheng mall up to version 1.0.3 allows a network-reachable, high-privileged authenticated attacker to perform unauthorized operations via the /admin/update/ Super Admin Password Handler endpoint. The intelligence tags this as an authentication bypass, suggesting a higher-privileged admin role boundary can be crossed - potentially allowing one admin to manipulate super admin credentials beyond their authorized scope. No public exploit identified at time of analysis; however, vendor behavior (deleting the GitHub disclosure issue without explanation and ignoring email contact) creates significant uncertainty around patch availability and actual vulnerability scope.
Improper authorization in macrozheng mall up to version 1.0.3 allows authenticated remote attackers to modify member address information via the /member/address/update/ endpoint, resulting in unauthorized data manipulation. The vulnerability affects the Member Endpoint component and has publicly available exploit code, though real-world exploitation risk is low based on EPSS scoring (0.05%, 14th percentile) and the requirement for prior authentication.
A vulnerability was detected in macrozheng mall up to 1.0.3. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was detected in macrozheng mall-swarm and mall up to 1.0.3. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A security vulnerability has been detected in macrozheng mall-swarm and mall up to 1.0.3. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A weakness has been identified in macrozheng mall-swarm and mall up to 1.0.3. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A security flaw has been discovered in macrozheng mall-swarm and mall up to 1.0.3. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in macrozheng mall up to 1.0.3. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in macrozheng mall up to 1.0.3. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in macrozheng mall up to 1.0.3. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
A vulnerability was found in macrozheng mall up to 1.0.3 and classified as problematic.java of the component com.macro.mall.portal.controller. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in macrozheng mall up to 1.0.3 and classified as problematic. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in macrozheng mall 1.0.3. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
A vulnerability was found in macrozheng mall up to 1.0.3. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
Cross-site scripting (XSS) in macrozheng mall up to version 1.0.3 allows authenticated remote attackers to inject malicious scripts via the configUrl parameter in the Swagger UI component (/swagger-ui/index.html). Exploitation requires user interaction (clicking a malicious link) and an authenticated session, limiting attack scope to integrity impact. Publicly available exploit code exists, and the vendor has not responded to early disclosure or patched the vulnerability.
A vulnerability classified as critical was found in Weitong Mall 1.0.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability classified as critical has been found in Weitong Mall 1.0.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability, which was classified as problematic, has been found in macrozheng mall up to 1.0.3. Rated low severity (CVSS 2.3), this vulnerability is no authentication required. No vendor patch available.
macrozheng mall e-commerce platform v1.0.3 has an authentication vulnerability in password reset enabling unauthorized account takeover.
Incorrect order money calculations in macrozheng mall 1.0.3 (commit dcaa93b) let a backend administrator manipulate the values processed by OmsOrderServiceImpl.updateMoneyInfo through the privileged /order/update/moneyInfo endpoint, producing deliberately wrong order totals. Exploitation requires an authenticated mall-admin session with administrative privileges (CVSS PR:H) plus operator interaction with the order-editing workflow (UI:P), so there is no anonymous or unauthenticated path; impact is confined to integrity of order money fields, with no data disclosure and no availability loss. No public exploit code has been identified at time of analysis and no EPSS scoring was supplied, and the vendor deleted the associated GitHub issue (#1004) without explanation, leaving no official patch guidance.
Business-logic manipulation in the MacroZheng mall e-commerce platform (mall-portal component) up to version 1.0.3 allows an authenticated storefront user to tamper with the coupon_amount and pay_amount parameters submitted to the /order/generateOrder endpoint, causing the OmsPortalOrderServiceImpl order-generation logic to compute incorrect order totals and payment records. The issue is a CWE-840 business-logic weakness rated 5.3 (CVSS 4.0) by the reporter; the assessed impact is limited to integrity (no confidentiality or availability effect), and exploitation requires a valid authenticated account plus the ability to submit an order - so it is a moderate-priority flaw rather than an urgent one. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no vendor patch was published; notably, the vendor deleted the associated GitHub issue without explanation, which reduces the information available to defenders.
Insufficient session expiration in MacroZheng Mall through 1.0.3 allows an attacker who already holds a valid low-privilege JWT for a disabled or deactivated account to keep that session alive by repeatedly calling the /admin/refreshToken endpoint, because JwtTokenUtil.validateToken verified only the username match and token non-expiry and omitted the userDetails.isEnabled() check. The issue is rated 5.3 (CVSS 4.0 vector with PR:L, E:P) with low confidentiality, integrity and availability impact and no scope change, and publicly available exploit code exists, although there is no confirmation of active exploitation. Effectively, the defect prevents account deactivation from taking effect on the token-refresh path, letting a terminated user retain access until the token is otherwise invalidated.
Payment-amount tampering in macrozheng mall through version 1.0.3 lets a customer-side attacker override the amount submitted to Alipay: the portal's payment endpoint passes the client-supplied total_amount straight into the Alipay bizContent instead of the order's stored payAmount, so an attacker with a valid order can alter what is charged or recorded. Exploitation requires a live Alipay integration and an authenticated customer account holding a legitimate outTradeNo, and impact is confined to order/payment integrity rather than code execution or data exposure (assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N). Public exploit code and the upstream fix commit are both available, but there is no indication the flaw is being actively exploited (not in CISA KEV).
Payment status workflow bypass in macrozheng mall up to version 1.0.3 allows authenticated remote attackers to manipulate the orderId parameter at the /order/paySuccess endpoint, potentially marking arbitrary orders as paid without completing actual payment. This CWE-841 business logic flaw directly threatens e-commerce transaction integrity - a proof-of-concept exists (CVSS 4.0 E:P), though no active exploitation is confirmed in CISA KEV. Notably, the vendor silently deleted the GitHub disclosure issue without providing any remediation, leaving no patch available at time of analysis.
Weak password recovery in macrozheng mall (commit 0504e86) exposes the /sso/getAuthCode endpoint of the mall-portal module to remote manipulation, enabling account takeover via a broken authentication flow. The flaw maps to CWE-640 and requires no authentication, though exploitation is rated high complexity. A publicly available exploit has been published; the vendor deleted the corresponding GitHub issue without explanation and has not responded to private disclosure.
Resource identifier manipulation in macrozheng mall up to 1.0.3 allows authenticated remote attackers to access or affect return-application records belonging to other users by substituting arbitrary orderId values in POST requests to /returnApply/create. The flaw is classified as CWE-99 (Improper Control of Resource Identifiers), consistent with an Insecure Direct Object Reference (IDOR) pattern in the Portal Endpoint. A public exploit is available, and the vendor deleted the corresponding GitHub issue without comment, raising concerns about coordinated disclosure and patch status.
Improper authorization (CWE-285) in macrozheng mall up to version 1.0.3 allows a network-reachable, high-privileged authenticated attacker to perform unauthorized operations via the /admin/update/ Super Admin Password Handler endpoint. The intelligence tags this as an authentication bypass, suggesting a higher-privileged admin role boundary can be crossed - potentially allowing one admin to manipulate super admin credentials beyond their authorized scope. No public exploit identified at time of analysis; however, vendor behavior (deleting the GitHub disclosure issue without explanation and ignoring email contact) creates significant uncertainty around patch availability and actual vulnerability scope.
Improper authorization in macrozheng mall up to version 1.0.3 allows authenticated remote attackers to modify member address information via the /member/address/update/ endpoint, resulting in unauthorized data manipulation. The vulnerability affects the Member Endpoint component and has publicly available exploit code, though real-world exploitation risk is low based on EPSS scoring (0.05%, 14th percentile) and the requirement for prior authentication.
A vulnerability was detected in macrozheng mall up to 1.0.3. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was detected in macrozheng mall-swarm and mall up to 1.0.3. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A security vulnerability has been detected in macrozheng mall-swarm and mall up to 1.0.3. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A weakness has been identified in macrozheng mall-swarm and mall up to 1.0.3. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A security flaw has been discovered in macrozheng mall-swarm and mall up to 1.0.3. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in macrozheng mall up to 1.0.3. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in macrozheng mall up to 1.0.3. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in macrozheng mall up to 1.0.3. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
A vulnerability was found in macrozheng mall up to 1.0.3 and classified as problematic.java of the component com.macro.mall.portal.controller. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in macrozheng mall up to 1.0.3 and classified as problematic. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in macrozheng mall 1.0.3. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
A vulnerability was found in macrozheng mall up to 1.0.3. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
Cross-site scripting (XSS) in macrozheng mall up to version 1.0.3 allows authenticated remote attackers to inject malicious scripts via the configUrl parameter in the Swagger UI component (/swagger-ui/index.html). Exploitation requires user interaction (clicking a malicious link) and an authenticated session, limiting attack scope to integrity impact. Publicly available exploit code exists, and the vendor has not responded to early disclosure or patched the vulnerability.
A vulnerability classified as critical was found in Weitong Mall 1.0.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability classified as critical has been found in Weitong Mall 1.0.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability, which was classified as problematic, has been found in macrozheng mall up to 1.0.3. Rated low severity (CVSS 2.3), this vulnerability is no authentication required. No vendor patch available.