Executive brief
macrozheng mall is an open-source e-commerce platform that manages orders and payments. An attacker can manipulate the orderId parameter in the payment status endpoint to bypass authorization controls and alter order workflows without proper validation, potentially allowing unauthorized access to orders and payments not belonging to them.
Technical details
The vulnerability exists in the /order/paySuccess endpoint of the Payment Status component in macrozheng mall up to version 1.0.3. The issue involves improper validation of the orderId parameter, allowing an attacker to manipulate this parameter to bypass authorization checks and enforce unauthorized workflow state changes on orders they should not have access to. The attack is network-reachable and does not require special privileges or user interaction beyond parameter manipulation. An attacker can modify order payment statuses or workflows for arbitrary orders, potentially leading to financial fraud or data manipulation. No patch has been released as of the advisory date.
Affected products
- macrozheng mall up to 1.0.3
Timeline
- 2026-08-29: disclosed