Mall4J
Monthly
Mall4j through version 4.0 allows any authenticated storefront customer to delete other shoppers' cart entries for off-shelf products by sending a single DELETE request to the /p/shopCart/cleanExpiryProdList endpoint, exploiting an operator precedence error in the cleanExpiryProdList SQL statement that fails to scope the deletion to the caller. This improper authorization flaw (CWE-783) has a CVSS 4.0 score of 5.3 with low integrity and availability impact and no confidentiality impact (PR:L), and publicly available exploit code exists. It is not listed in CISA KEV, and no active exploitation has been confirmed.
Authenticated shoppers on mall4j through version 4.0 can read other customers' off-shelf cart entries - product, SKU, quantity, shop and promoter card numbers - by calling GET /p/shopCart/expiryProdList on the storefront API. Exploitation is medium severity (CVSS 4.0 base 5.3, confidentiality-only): it requires only a self-registered low-privileged account, no administrative rights, no user interaction and no non-default configuration, because the flaw sits in the default getShopCartExpiryItems SQL logic. Publicly available exploit code exists; no confirmed active exploitation has been reported and no vendor-released patch has been identified at time of analysis.
Mall4j through version 4.0 allows any authenticated storefront customer to delete other shoppers' cart entries for off-shelf products by sending a single DELETE request to the /p/shopCart/cleanExpiryProdList endpoint, exploiting an operator precedence error in the cleanExpiryProdList SQL statement that fails to scope the deletion to the caller. This improper authorization flaw (CWE-783) has a CVSS 4.0 score of 5.3 with low integrity and availability impact and no confidentiality impact (PR:L), and publicly available exploit code exists. It is not listed in CISA KEV, and no active exploitation has been confirmed.
Authenticated shoppers on mall4j through version 4.0 can read other customers' off-shelf cart entries - product, SKU, quantity, shop and promoter card numbers - by calling GET /p/shopCart/expiryProdList on the storefront API. Exploitation is medium severity (CVSS 4.0 base 5.3, confidentiality-only): it requires only a self-registered low-privileged account, no administrative rights, no user interaction and no non-default configuration, because the flaw sits in the default getShopCartExpiryItems SQL logic. Publicly available exploit code exists; no confirmed active exploitation has been reported and no vendor-released patch has been identified at time of analysis.