| 제목 | macrozheng mall 1.0.3 Incorrect Calculation |
|---|
| 설명 | An incorrect calculation vulnerability exists in the administrative order fee-adjustment workflow of macrozheng/mall, affecting the mall-admin and mall-portal modules. The affected implementation was reviewed at commit dcaa93b3150352e5044708d7211b5bed0af4509f.
The POST /order/update/moneyInfo endpoint invokes OmsOrderServiceImpl.updateMoneyInfo(), which updates oms_order.freight_amount and oms_order.discount_amount without recalculating oms_order.pay_amount. Consequently, an accepted freight adjustment can leave the stored payable inconsistent with the order's monetary components.
The GET /alipay/pay and GET /alipay/webPay endpoints use this stored pay_amount as the payment request's total_amount. After an authorized administrator increases freight on an unpaid order, the buyer can initiate payment using the previous, lower payable. Freight reductions can similarly cause overcharging. The payment-success handlers do not recalculate the adjusted payable before transitioning an eligible unpaid order to the awaiting-shipment state.
This defect compromises order amount integrity and can result in incorrect payment amounts. The underlying weakness is CWE-682: Incorrect Calculation.
The vulnerability has been reported to the project through [GitHub Issue #1004](https://github.com/macrozheng/mall/issues/1004), which provides the technical analysis, reproduction details, and observed database results.
|
|---|
| 원천 | ⚠️ https://github.com/macrozheng/mall/issues/1004 |
|---|
| 사용자 | Anonymous User |
|---|
| 제출 | 2026. 09. 16. AM 05:06 (29 날 ago) |
|---|
| 모더레이션 | 2026. 10. 12. PM 05:03 (26 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 416952 [macrozheng mall 1.0.3 dcaa93b mall-admin/mall-portal /order/update/moneyInfo OmsOrderServiceImpl.updateMoneyInfo] |
|---|
| 포인트들 | 20 |
|---|