| Título | macrozheng mall 1.0.3 Input Validation |
|---|
| Descrição | The POST /order/paySuccess endpoint allows authenticated users to mark an order as paid without verifying the order's current status. This violates the order state machine semantics, which define that only orders in status=0 (pending payment) should transition to status=1 (paid). An authenticated attacker can place an order, cancel it (status=4), and then call paySuccess on the same order to revert it to status=1 (paid). This causes a return to a terminal state (cancelled) to a non-terminal state (paid), which is not business-logic compliant.
This vulnerability is distinct from CVE-2025-13118 (IDOR/cross-user order manipulation) because it can be triggered by a user operating exclusively on their own orders. Proof of concept: login, create an order, cancel it via /order/cancelUserOrder, then call /order/paySuccess?orderId={cancelledOrderId} and observe HTTP 200 with order status changed from 4 to 1. This is classified as CWE-636 (Improper Enforcement of Behavioral Workflow) or CWE-20 (Improper Input Validation). The issue affects all versions up to 1.0.3. The developer has been contacted through GitHub but has not responded to previous security reports. |
|---|
| Fonte | ⚠️ https://github.com/macrozheng/mall/issues/985 |
|---|
| Utilizador | Anonymous User |
|---|
| Submissão | 13/07/2026 07h10 (há 2 meses) |
|---|
| Moderação | 29/08/2026 08h29 (2 months later) |
|---|
| Estado | Aceite |
|---|
| Entrada VulDB | 397008 [macrozheng mall até 1.0.3 Payment Status Endpoint /order/paySuccess orderId Elevação de Privilégios] |
|---|
| Pontos | 20 |
|---|