Executive brief
macrozheng mall is an open-source e-commerce system used to build online shopping platforms with order management and payment processing. A race condition in the order submission endpoint (/order/submit) allows attackers to manipulate the order flow by exploiting timing gaps, potentially leading to unauthorized orders or financial losses. The vendor removed the GitHub issue without explanation, limiting the transparency of the fix.
Technical details
The vulnerability is a race condition in the /order/submit endpoint of the order submission component in macrozheng mall up to version 1.0.3. The race condition occurs when multiple concurrent requests are processed without proper synchronization, allowing an attacker to manipulate order state or bypass validation. The attack requires network access and is considered high complexity to exploit. The exact impact is not fully documented, but race conditions in order submission typically allow duplicate charges, inventory inconsistency, or unauthorized transaction manipulation. A patch or update is not yet confirmed to be publicly available.
Affected products
- macrozheng mall up to 1.0.3
Timeline
- 2026-08-29: disclosed