Waynboot Mall
Monthly
Unauthenticated email relay in waynboot-mall 2.0.0 and earlier lets anyone who can reach the application POST a caller-chosen subject, body, and recipient to the anonymously mapped /callback/email endpoint (EmailController.sendEmail), causing messages to be sent from the operator's own configured SMTP account. Because that path is permitted without authentication in the default Spring Security configuration, a default, network-reachable deployment with working SMTP credentials is directly abusable for phishing, spam, and mail-quota exhaustion, while the independent assessment rates it moderate severity since impact is confined to outbound mail integrity (I:L) with no confidentiality or availability loss. No public exploit identified at time of analysis, although a public technical writeup of the callback abuse is referenced, and the CVE is not listed in CISA KEV.
Unauthenticated attackers can cancel any member's pending unpaid orders in waynboot-mall through 2.0.0 by calling the /callback/order/unpaid endpoint directly, because that callback handler performs no authentication and accepts the order identifier from attacker-controlled input. Order identifiers (orderSn) are generated from epoch seconds plus a sequential counter, so they are predictable enough to enumerate or guess, allowing an attacker to repeatedly cancel live orders and distort product stock levels. No vendor patch has been identified and no public exploit code was confirmed at time of analysis, although a public technical writeup describing the flaw exists; the impact is bounded to order-state and inventory manipulation rather than data disclosure or account takeover.
Unauthenticated order forgery in Waynboot-mall through 2.0.0 allows remote attackers to create fraudulent orders, expose stored shipping details, clear carts, and decrement stock by invoking the internal /callback/order/submit message-queue callback. The endpoint is exposed without authentication by the application's SecurityConfig, so no credentials or user interaction are required; attackers supply arbitrary userId, addressId, and cart IDs in the order JSON. Exploitability hinges on network reachability-an internet-exposed instance is trivially exploitable, whereas an internal-only deployment limits the attack to parties with network access; no public exploit code or active exploitation is identified at time of analysis (CVSS 4.0 base 6.9; independent assessment aligns with CVSS 3.1 base 6.5).
Unauthenticated email relay in waynboot-mall 2.0.0 and earlier lets anyone who can reach the application POST a caller-chosen subject, body, and recipient to the anonymously mapped /callback/email endpoint (EmailController.sendEmail), causing messages to be sent from the operator's own configured SMTP account. Because that path is permitted without authentication in the default Spring Security configuration, a default, network-reachable deployment with working SMTP credentials is directly abusable for phishing, spam, and mail-quota exhaustion, while the independent assessment rates it moderate severity since impact is confined to outbound mail integrity (I:L) with no confidentiality or availability loss. No public exploit identified at time of analysis, although a public technical writeup of the callback abuse is referenced, and the CVE is not listed in CISA KEV.
Unauthenticated attackers can cancel any member's pending unpaid orders in waynboot-mall through 2.0.0 by calling the /callback/order/unpaid endpoint directly, because that callback handler performs no authentication and accepts the order identifier from attacker-controlled input. Order identifiers (orderSn) are generated from epoch seconds plus a sequential counter, so they are predictable enough to enumerate or guess, allowing an attacker to repeatedly cancel live orders and distort product stock levels. No vendor patch has been identified and no public exploit code was confirmed at time of analysis, although a public technical writeup describing the flaw exists; the impact is bounded to order-state and inventory manipulation rather than data disclosure or account takeover.
Unauthenticated order forgery in Waynboot-mall through 2.0.0 allows remote attackers to create fraudulent orders, expose stored shipping details, clear carts, and decrement stock by invoking the internal /callback/order/submit message-queue callback. The endpoint is exposed without authentication by the application's SecurityConfig, so no credentials or user interaction are required; attackers supply arbitrary userId, addressId, and cart IDs in the order JSON. Exploitability hinges on network reachability-an internet-exposed instance is trivially exploitable, whereas an internal-only deployment limits the attack to parties with network access; no public exploit code or active exploitation is identified at time of analysis (CVSS 4.0 base 6.9; independent assessment aligns with CVSS 3.1 base 6.5).