CVE-2025-13117
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
A security vulnerability has been detected in macrozheng mall-swarm and mall up to 1.0.3. The cancelOrder function in /order/cancelOrder is affected; manipulation of the orderId argument leads to improper authorization. The attack can be initiated remotely, the exploit has been disclosed publicly, and the vendor did not respond.
Risk Assessment
Attackers can remotely cancel orders without proper authorization, potentially disrupting operations and compromising data integrity.
Recommendation
Apply a patch or mitigation as soon as possible since the exploit is public; consider restricting access to the endpoint to trusted users.
Other vulnerabilities in macrozheng mall-swarm and mall
See all- CVE-2025-13116Medium
A weakness has been identified in macrozheng mall-swarm and mall up to 1.0.3. The cancelUserOrder function in /order/cancelUserOrder is affected; manipulation of the orderId argument can lead to improper authorization. The attack can be launched remotely, the exploit is publicly available, and the vendor did not respond.
- CVE-2025-13115Medium
A security flaw has been discovered in macrozheng mall-swarm and mall up to 1.0.3. This impacts the function detail of the file /order/detail/ of the component Order Details Handler. Performing manipulation of the argument orderId results in improper authorization. It is possible to initiate the attack remotely. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
Original NVD description (English source)
A security vulnerability has been detected in macrozheng mall-swarm and mall up to 1.0.3. Affected by this vulnerability is the function cancelOrder of the file /order/cancelOrder. The manipulation of the argument orderId leads to improper authorization. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS