| Título | macrozheng mall 1.0.3 Incorrect Calculation |
|---|
| Descrição | An incorrect calculation vulnerability exists in the administrative order fee-adjustment workflow of macrozheng/mall, affecting the mall-admin and mall-portal modules. The affected implementation was reviewed at commit dcaa93b3150352e5044708d7211b5bed0af4509f.
The POST /order/update/moneyInfo endpoint invokes OmsOrderServiceImpl.updateMoneyInfo(), which updates oms_order.freight_amount and oms_order.discount_amount without recalculating oms_order.pay_amount. Consequently, an accepted freight adjustment can leave the stored payable inconsistent with the order's monetary components.
The GET /alipay/pay and GET /alipay/webPay endpoints use this stored pay_amount as the payment request's total_amount. After an authorized administrator increases freight on an unpaid order, the buyer can initiate payment using the previous, lower payable. Freight reductions can similarly cause overcharging. The payment-success handlers do not recalculate the adjusted payable before transitioning an eligible unpaid order to the awaiting-shipment state.
This defect compromises order amount integrity and can result in incorrect payment amounts. The underlying weakness is CWE-682: Incorrect Calculation.
The vulnerability has been reported to the project through [GitHub Issue #1004](https://github.com/macrozheng/mall/issues/1004), which provides the technical analysis, reproduction details, and observed database results.
|
|---|
| Fonte | ⚠️ https://github.com/macrozheng/mall/issues/1004 |
|---|
| Utilizador | Anonymous User |
|---|
| Submissão | 16/09/2026 05h06 (há 28 dias) |
|---|
| Moderação | 12/10/2026 17h03 (26 days later) |
|---|
| Estado | Aceite |
|---|
| Entrada VulDB | 416952 [macrozheng mall 1.0.3 dcaa93b mall-admin/mall-portal /order/update/moneyInfo OmsOrderServiceImpl.updateMoneyInfo] |
|---|
| Pontos | 20 |
|---|