Peanutbutter

A security vulnerability has been detected in macrozheng mall up to 1.0.3. This issue affects some unknown processing of the file /order/generateOrder of the component Coupon Redemption. Such manipulation of the argument couponId leads to race condition. The attack may be performed from remote. The attack requires a high level of complexity. The exploitability is assessed as difficult. The vendor deleted the GitHub issue for this vulnerability without any explanation.

A vulnerability has been found in macrozheng mall 1.0.3 dcaa93b. The impacted element is the function OmsOrderServiceImpl.updateMoneyInfo of the file /order/update/moneyInfo of the component mall-admin/mall-portal. The manipulation leads to incorrect calculation. The attack can be initiated remotely. The vendor deleted the GitHub issue for this vulnerability without any explanation.

A weakness has been identified in macrozheng mall up to 1.0.3. This vulnerability affects the function OmsPortalOrderServiceImpl of the file /order/generateOrder of the component mall-portal. This manipulation of the argument coupon amount/pay amount causes business logic errors. The attack is possible to be carried out remotely. The vendor deleted the GitHub issue for this vulnerability without any explanation.

**Name of the Vulnerable Software and Affected Versions** macrozheng mall versions prior to 1.0.4 **Description** A remote issue exists in the Payment Status Endpoint component within the `/order/paySuccess` file. Manipulation of the `orderId` argument allows an attacker to enforce a behavioral workflow. **Recommendations** Update macrozheng mall to version 1.0.4 or later. As a temporary mitigation, restrict access to the `/order/paySuccess` endpoint or avoid using the `orderId` parameter until the update is applied.

**Name of the Vulnerable Software and Affected Versions** macrozheng mall versions prior to 1.0.4 **Description** A race condition exists in the Order Submission component within the '/order/submit' endpoint. This issue allows a remote attacker to manipulate the system, although the attack is characterized by high complexity and difficult exploitability. **Recommendations** Update macrozheng mall to version 1.0.4 or later. As a temporary mitigation, restrict access to the '/order/submit' endpoint.

**Name of the Vulnerable Software and Affected Versions** macrozheng mall versions prior to 1.0.4 **Description** A business logic error exists that can be triggered remotely. The issue resides in the `OmsCartItemServiceImpl.updateQuantity()` function within the '/cart/update/quantity' endpoint. An attacker can exploit this by manipulating the `quantity` argument. **Recommendations** Update macrozheng mall to version 1.0.4 or later. As a temporary workaround, restrict access to the '/cart/update/quantity' endpoint or monitor the `quantity` argument for unusual values.

**Name of the Vulnerable Software and Affected Versions** macrozheng mall versions prior to 1.0.4 **Description** An issue exists in the Portal Endpoint component within the file `/returnApply/create`. Remote manipulation of the `orderId` variable leads to improper control of resource identifiers, which can be exploited to gain unauthorized access to resources. **Recommendations** Update macrozheng mall to version 1.0.4 or later. As a temporary mitigation, restrict access to the `/returnApply/create` endpoint.