| عنوان | macrozheng mall 1.0.3 Incorrect Calculation |
|---|
| الوصف | An incorrect calculation vulnerability exists in the administrative order fee-adjustment workflow of macrozheng/mall, affecting the mall-admin and mall-portal modules. The affected implementation was reviewed at commit dcaa93b3150352e5044708d7211b5bed0af4509f.
The POST /order/update/moneyInfo endpoint invokes OmsOrderServiceImpl.updateMoneyInfo(), which updates oms_order.freight_amount and oms_order.discount_amount without recalculating oms_order.pay_amount. Consequently, an accepted freight adjustment can leave the stored payable inconsistent with the order's monetary components.
The GET /alipay/pay and GET /alipay/webPay endpoints use this stored pay_amount as the payment request's total_amount. After an authorized administrator increases freight on an unpaid order, the buyer can initiate payment using the previous, lower payable. Freight reductions can similarly cause overcharging. The payment-success handlers do not recalculate the adjusted payable before transitioning an eligible unpaid order to the awaiting-shipment state.
This defect compromises order amount integrity and can result in incorrect payment amounts. The underlying weakness is CWE-682: Incorrect Calculation.
The vulnerability has been reported to the project through [GitHub Issue #1004](https://github.com/macrozheng/mall/issues/1004), which provides the technical analysis, reproduction details, and observed database results.
|
|---|
| المصدر | ⚠️ https://github.com/macrozheng/mall/issues/1004 |
|---|
| المستخدم | Anonymous User |
|---|
| ارسال | 16/09/2026 05:06 AM (27 أيام منذ) |
|---|
| الاعتدال | 12/10/2026 05:03 PM (26 days later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 416952 [macrozheng mall 1.0.3 dcaa93b mall-admin/mall-portal /order/update/moneyInfo OmsOrderServiceImpl.updateMoneyInfo] |
|---|
| النقاط | 20 |
|---|