Submeter #624046: macrozheng mall 1.0.3 Missing Authorization

A critical authorization vulnerability exists in the e-commerce platform's order functionality. Any user can gain unauthorized access to any order in the system by manipulating the order ID parameter in the corresponding API request. The application fails to perform an object-level authorization check to verify that the user requesting the order details is the legitimate owner of that order.

Furthermore, the order IDs are sequential (auto-incrementing integers), which makes it trivial for an attacker to write a simple script to enumerate and exfiltrate all order records from the database. The exposed order information contains highly sensitive Personally Identifiable Information (PII) and Transactional Data, including the customer's name, full shipping address, phone number and purchased item details, leading to a massive data breach. The combination of this data creates a clear profile of an individual, making it exceptionally valuable to malicious attacker.

• Fonte: ⚠️ https://github.com/N1n3b9S/cve/issues/14
• Utilizador: Anonymous User
• Submissão: 28/07/2025 11h37 (há 11 meses)
• Moderação: 08/08/2025 17h20 (11 days later)
• Estado: Aceite
• Entrada VulDB: 319253 [macrozheng mall até 1.0.3 com.macro.mall.portal.controller UmsMemberController.java detail orderId Elevação de Privilégios]
• Pontos: 20