Submit #979872: macrozheng mall 1.0.3 Time-of-check Time-of-use

A race condition in macrozheng/mall affects coupon redemption through POST /order/generateOrder in mall-portal. The relevant implementation is present in v1.0.3 and commit 0504e86.

Although generateOrder is declared transactional, coupon availability checking and subsequent consumption do not enforce exclusive redemption of a coupon claim. The application queries unused coupon-history records and later updates a selected record by primary key, without requiring use_status=0 in the update predicate or verifying that the request exclusively consumed an unused claim. Concurrent transactions can therefore grant coupon deductions based on the same unused state.

In the reported concurrent test, five requests from the same authenticated member using couponId=32 returned successful order-creation responses for distinct order IDs 97–101, each carrying a CNY 1,000.00 coupon deduction. The before-and-after database snapshots show only one displayed coupon-history record changing from unused to used. These observations are consistent with repeated coupon application without corresponding consumption of distinct coupon claims.

Remediation should conditionally consume a specific eligible claim using an update that requires use_status=0, verify that exactly one row was updated, and roll back order creation if consumption fails. The claim update and order creation must occur within the same transaction. Alternatively, lock and revalidate the selected claim using SELECT ... FOR UPDATE before granting the deduction, retaining the lock until the transaction completes. Full reproduction evidence is provided in the linked advisory.

• Source: ⚠️ https://github.com/macrozheng/mall/issues/1003
• User: Anonymous User
• Submission: 09/15/2026 11:59 (27 days ago)
• Moderation: 10/12/2026 16:47 (27 days later)
• Status: Accepted
• VulDB entry: 416949 [macrozheng mall up to 1.0.3 Coupon Redemption /order/generateOrder couponId race condition]
• Points: 20