| 제목 | macrozheng mall 1.0.3 Input Validation |
|---|
| 설명 | The POST /order/paySuccess endpoint allows authenticated users to mark an order as paid without verifying the order's current status. This violates the order state machine semantics, which define that only orders in status=0 (pending payment) should transition to status=1 (paid). An authenticated attacker can place an order, cancel it (status=4), and then call paySuccess on the same order to revert it to status=1 (paid). This causes a return to a terminal state (cancelled) to a non-terminal state (paid), which is not business-logic compliant.
This vulnerability is distinct from CVE-2025-13118 (IDOR/cross-user order manipulation) because it can be triggered by a user operating exclusively on their own orders. Proof of concept: login, create an order, cancel it via /order/cancelUserOrder, then call /order/paySuccess?orderId={cancelledOrderId} and observe HTTP 200 with order status changed from 4 to 1. This is classified as CWE-636 (Improper Enforcement of Behavioral Workflow) or CWE-20 (Improper Input Validation). The issue affects all versions up to 1.0.3. The developer has been contacted through GitHub but has not responded to previous security reports. |
|---|
| 원천 | ⚠️ https://github.com/macrozheng/mall/issues/985 |
|---|
| 사용자 | Anonymous User |
|---|
| 제출 | 2026. 07. 13. AM 07:10 (2 개월 ago) |
|---|
| 모더레이션 | 2026. 08. 29. AM 08:29 (2 months later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 397008 [macrozheng mall 까지 1.0.3 Payment Status Endpoint /order/paySuccess orderId 권한 상승] |
|---|
| 포인트들 | 20 |
|---|