Отправить #887391: macrozheng mall 1.0.3 Input Validation

The POST /order/paySuccess endpoint allows authenticated users to mark an order as paid without verifying the order's current status. This violates the order state machine semantics, which define that only orders in status=0 (pending payment) should transition to status=1 (paid). An authenticated attacker can place an order, cancel it (status=4), and then call paySuccess on the same order to revert it to status=1 (paid). This causes a return to a terminal state (cancelled) to a non-terminal state (paid), which is not business-logic compliant.
This vulnerability is distinct from CVE-2025-13118 (IDOR/cross-user order manipulation) because it can be triggered by a user operating exclusively on their own orders. Proof of concept: login, create an order, cancel it via /order/cancelUserOrder, then call /order/paySuccess?orderId={cancelledOrderId} and observe HTTP 200 with order status changed from 4 to 1. This is classified as CWE-636 (Improper Enforcement of Behavioral Workflow) or CWE-20 (Improper Input Validation). The issue affects all versions up to 1.0.3. The developer has been contacted through GitHub but has not responded to previous security reports.

• Источник: ⚠️ https://github.com/macrozheng/mall/issues/985
• Пользователь: Anonymous User
• Представление: 13.07.2026 07:10 (2 месяцы назад)
• Модерация: 29.08.2026 08:29 (2 months later)
• Статус: принято
• Запись VulDB: 397008 [macrozheng mall до 1.0.3 Payment Status Endpoint /order/paySuccess orderId эскалация привилегий]
• Баллы: 20