| Título | macrozheng mall 1.0.3 Incorrect Calculation |
|---|
| Descripción | An incorrect calculation vulnerability exists in the administrative order fee-adjustment workflow of macrozheng/mall, affecting the mall-admin and mall-portal modules. The affected implementation was reviewed at commit dcaa93b3150352e5044708d7211b5bed0af4509f.
The POST /order/update/moneyInfo endpoint invokes OmsOrderServiceImpl.updateMoneyInfo(), which updates oms_order.freight_amount and oms_order.discount_amount without recalculating oms_order.pay_amount. Consequently, an accepted freight adjustment can leave the stored payable inconsistent with the order's monetary components.
The GET /alipay/pay and GET /alipay/webPay endpoints use this stored pay_amount as the payment request's total_amount. After an authorized administrator increases freight on an unpaid order, the buyer can initiate payment using the previous, lower payable. Freight reductions can similarly cause overcharging. The payment-success handlers do not recalculate the adjusted payable before transitioning an eligible unpaid order to the awaiting-shipment state.
This defect compromises order amount integrity and can result in incorrect payment amounts. The underlying weakness is CWE-682: Incorrect Calculation.
The vulnerability has been reported to the project through [GitHub Issue #1004](https://github.com/macrozheng/mall/issues/1004), which provides the technical analysis, reproduction details, and observed database results.
|
|---|
| Fuente | ⚠️ https://github.com/macrozheng/mall/issues/1004 |
|---|
| Usuario | Anonymous User |
|---|
| Sumisión | 2026-09-16 05:06 (hace 27 días) |
|---|
| Moderación | 2026-10-12 17:03 (26 days later) |
|---|
| Estado | Aceptado |
|---|
| Entrada de VulDB | 416952 [macrozheng mall 1.0.3 dcaa93b mall-admin/mall-portal /order/update/moneyInfo OmsOrderServiceImpl.updateMoneyInfo] |
|---|
| Puntos | 20 |
|---|