提出 #887391: macrozheng mall 1.0.3 Input Validation

The POST /order/paySuccess endpoint allows authenticated users to mark an order as paid without verifying the order's current status. This violates the order state machine semantics, which define that only orders in status=0 (pending payment) should transition to status=1 (paid). An authenticated attacker can place an order, cancel it (status=4), and then call paySuccess on the same order to revert it to status=1 (paid). This causes a return to a terminal state (cancelled) to a non-terminal state (paid), which is not business-logic compliant.
This vulnerability is distinct from CVE-2025-13118 (IDOR/cross-user order manipulation) because it can be triggered by a user operating exclusively on their own orders. Proof of concept: login, create an order, cancel it via /order/cancelUserOrder, then call /order/paySuccess?orderId={cancelledOrderId} and observe HTTP 200 with order status changed from 4 to 1. This is classified as CWE-636 (Improper Enforcement of Behavioral Workflow) or CWE-20 (Improper Input Validation). The issue affects all versions up to 1.0.3. The developer has been contacted through GitHub but has not responded to previous security reports.

• ソース: ⚠️ https://github.com/macrozheng/mall/issues/985
• ユーザー: Anonymous User
• 送信: 2026年07月13日 07:10 (2 月 ago)
• モデレーション: 2026年08月29日 08:29 (2 months later)
• ステータス: 承諾済み
• VulDBエントリ: 397008 [macrozheng mall 迄 1.0.3 Payment Status Endpoint /order/paySuccess orderId 特権昇格]
• ポイント: 20