macrozheng mall-swarm and mall vulnerabilities

A security vulnerability has been detected in macrozheng mall-swarm and mall up to 1.0.3. The cancelOrder function in /order/cancelOrder is affected; manipulation of the orderId argument leads to improper authorization. The attack can be initiated remotely, the exploit has been disclosed publicly, and the vendor did not respond.

A weakness has been identified in macrozheng mall-swarm and mall up to 1.0.3. The cancelUserOrder function in /order/cancelUserOrder is affected; manipulation of the orderId argument can lead to improper authorization. The attack can be launched remotely, the exploit is publicly available, and the vendor did not respond.

A security flaw has been discovered in macrozheng mall-swarm and mall up to 1.0.3. This impacts the function detail of the file /order/detail/ of the component Order Details Handler. Performing manipulation of the argument orderId results in improper authorization. It is possible to initiate the attack remotely. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way.