Description

A vulnerability has been found in macrozheng mall up to 1.0.3. The affected element is an unknown function of the file /order/paySuccess of the component Payment Status Endpoint. The manipulation of the argument orderId leads to enforcement of behavioral workflow. The attack is possible to be carried out remotely. The vendor deleted the GitHub issue for this vulnerability without any explanation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-29T23:17:23.900Z",
  "pubdate": "2026-08-29T23:17:23.900Z",
  "executiveSummary": "A vulnerability has been identified in the macrozheng mall application, specifically within the /order/paySuccess endpoint, affecting versions up to 1.0.3.\nThe issue is classified as an improper enforcement of behavioral workflow, where the manipulation of the orderId parameter allows for unauthorized state transitions.\nThis vulnerability is remotely exploitable and poses a significant risk to the integrity of the order processing lifecycle.\nAn unauthenticated or authenticated attacker capable of reaching the payment success endpoint can trigger logic flaws by providing arbitrary order identifiers.\nThe primary impact involves the potential for bypassing payment verification logic, potentially leading to unauthorized fulfillment of orders or state inconsistency within the backend database.\nThe lack of transparency from the vendor, evidenced by the removal of the issue report, necessitates independent assessment and manual implementation of security controls to mitigate potential unauthorized workflow bypasses.",
  "technicalDetails": "The vulnerability resides within the /order/paySuccess component of the macrozheng mall application, specifically impacting versions up to 1.0.3.\nThe root cause is identified as an Improper Authorization or broken function-level access control, which allows an attacker to manipulate the behavioral workflow by interacting with the orderId argument.\nIn a typical e-commerce workflow, the /order/paySuccess endpoint is expected to be invoked only by a payment gateway provider (e.g., Alipay, WeChat Pay) following a successful callback. This endpoint is designed to transition an order status from 'pending' to 'paid'.\nBecause the system fails to verify the authenticity of the request or the validity of the state transition triggered by the provided orderId, the endpoint is susceptible to forced browsing and direct parameter manipulation.\nThe attack flow proceeds as follows: An attacker identifies the target orderId through enumeration or other reconnaissance techniques. The attacker then crafts a malicious HTTP GET or POST request directed at the /order/paySuccess endpoint, injecting the captured orderId into the query parameters or request body.\nUpon receiving the request, the application fails to perform a cryptographic signature verification or a session-based check to ensure that the payment for the specified orderId was actually initiated or completed by a trusted third party. Instead, the application trusts the input provided in the orderId argument implicitly.\nThis results in the backend service updating the order status in the database to 'Paid' despite no actual funds being transferred or verified. Consequently, the business logic forces a state transition that the system should have protected, effectively bypassing the payment workflow.\nBecause the service is accessible remotely, the attack surface is exposed to the public internet, requiring no special privileges if the endpoint lacks adequate authentication middleware.\nPost-exploitation impact includes the potential for attackers to trigger unauthorized inventory deduction, shipment processing, or reward point issuance, leading to significant financial and operational fraud."
}