CVE-2025-15084
LowCVSS 3.1Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
A vulnerability in youlaitech youlai-mall 1.0.0/2.0.0 in the orderService.payOrder function leads to improper access controls. The attack can be initiated remotely but has high complexity and is difficult to exploit. The exploit is publicly available and the vendor has not responded.
Risk Assessment
Risk of unauthorized access to payment functions, potentially leading to order manipulation or transaction integrity issues.
Recommendation
Upgrade youlai-mall to the latest version or implement proper access controls in the payOrder function.
Other vulnerabilities in youlai-mall
See all- CVE-2025-15087Medium
A security vulnerability has been detected in youlai-mall 1.0.0/2.0.0 in the submitOrderPayment function of OrderController.java. Manipulation of the orderSn argument leads to improper authorization, and the attack may be launched remotely. The exploit has been disclosed publicly and may be used.
- CVE-2025-15086Medium
A weakness has been identified in youlai-mall 1.0.0/2.0.0. This impacts the function getMemberByMobile in the file mall-ums/ums-boot/src/main/java/com/youlai/mall/ums/controller/app/MemberController.java. The manipulation causes improper access controls. The attack may be initiated remotely, and the exploit has been made available to the public.
- CVE-2025-15085Medium
A security flaw has been discovered in youlai-mall versions 1.0.0 and 2.0.0 affecting the deductBalance function in MemberController.java. The manipulation results in improper authorization and can be launched remotely. The exploit has been released to the public and may be exploited.
- CVE-2025-14052Medium
A vulnerability has been found in youlaitech youlai-mall versions 1.0.0 and 2.0.0. The function getMemberById in /mall-ums/app-api/v1/members/ is affected. Manipulation of the argument memberId leads to improper access controls. The attack can be carried out remotely and the exploit is public.
Original NVD description (English source)
A vulnerability was identified in youlaitech youlai-mall 1.0.0/2.0.0. The impacted element is the function orderService.payOrder of the file mall-oms/oms-boot/src/main/java/com/youlai/mall/oms/controller/app/OrderController.java of the component Order Payment Handler. The manipulation leads to improper access controls. The attack can be initiated remotely. The attack is considered to have high complexity. The exploitability is regarded as difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS