CVE-2025-13116
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
A weakness has been identified in macrozheng mall-swarm and mall up to 1.0.3. The cancelUserOrder function in /order/cancelUserOrder is affected; manipulation of the orderId argument can lead to improper authorization. The attack can be launched remotely, the exploit is publicly available, and the vendor did not respond.
Risk Assessment
Attackers can remotely cancel user orders without required permissions, potentially disrupting operations and compromising data integrity.
Recommendation
Immediately apply a patch or mitigation since the exploit is public; consider restricting access to the endpoint.
Other vulnerabilities in macrozheng mall-swarm and mall
See all- CVE-2025-13117Medium
A security vulnerability has been detected in macrozheng mall-swarm and mall up to 1.0.3. The cancelOrder function in /order/cancelOrder is affected; manipulation of the orderId argument leads to improper authorization. The attack can be initiated remotely, the exploit has been disclosed publicly, and the vendor did not respond.
- CVE-2025-13115Medium
A security flaw has been discovered in macrozheng mall-swarm and mall up to 1.0.3. This impacts the function detail of the file /order/detail/ of the component Order Details Handler. Performing manipulation of the argument orderId results in improper authorization. It is possible to initiate the attack remotely. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
Original NVD description (English source)
A weakness has been identified in macrozheng mall-swarm and mall up to 1.0.3. Affected is the function cancelUserOrder of the file /order/cancelUserOrder. Executing manipulation of the argument orderId can lead to improper authorization. It is possible to launch the attack remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS