CVE-2025-13115
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
A security flaw has been discovered in macrozheng mall-swarm and mall up to 1.0.3. This impacts the function detail of the file /order/detail/ of the component Order Details Handler. Performing manipulation of the argument orderId results in improper authorization. It is possible to initiate the attack remotely. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
Risk Assessment
This may allow an attacker to gain unauthorized access to other users' order details.
Recommendation
Update the system to a version that fixes the vulnerability or implement authorization patches.
Other vulnerabilities in macrozheng mall-swarm and mall
See all- CVE-2025-13117Medium
A security vulnerability has been detected in macrozheng mall-swarm and mall up to 1.0.3. The cancelOrder function in /order/cancelOrder is affected; manipulation of the orderId argument leads to improper authorization. The attack can be initiated remotely, the exploit has been disclosed publicly, and the vendor did not respond.
- CVE-2025-13116Medium
A weakness has been identified in macrozheng mall-swarm and mall up to 1.0.3. The cancelUserOrder function in /order/cancelUserOrder is affected; manipulation of the orderId argument can lead to improper authorization. The attack can be launched remotely, the exploit is publicly available, and the vendor did not respond.
Original NVD description (English source)
A security flaw has been discovered in macrozheng mall-swarm and mall up to 1.0.3. This impacts the function detail of the file /order/detail/ of the component Order Details Handler. Performing manipulation of the argument orderId results in improper authorization. It is possible to initiate the attack remotely. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS