youlai-mall vulnerabilities

A security vulnerability has been detected in youlai-mall 1.0.0/2.0.0 in the submitOrderPayment function of OrderController.java. Manipulation of the orderSn argument leads to improper authorization, and the attack may be launched remotely. The exploit has been disclosed publicly and may be used.

A weakness has been identified in youlai-mall 1.0.0/2.0.0. This impacts the function getMemberByMobile in the file mall-ums/ums-boot/src/main/java/com/youlai/mall/ums/controller/app/MemberController.java. The manipulation causes improper access controls. The attack may be initiated remotely, and the exploit has been made available to the public.

A security flaw has been discovered in youlai-mall versions 1.0.0 and 2.0.0 affecting the deductBalance function in MemberController.java. The manipulation results in improper authorization and can be launched remotely. The exploit has been released to the public and may be exploited.

A vulnerability in youlaitech youlai-mall 1.0.0/2.0.0 in the orderService.payOrder function leads to improper access controls. The attack can be initiated remotely but has high complexity and is difficult to exploit. The exploit is publicly available and the vendor has not responded.

A vulnerability has been found in youlaitech youlai-mall versions 1.0.0 and 2.0.0. The function getMemberById in /mall-ums/app-api/v1/members/ is affected. Manipulation of the argument memberId leads to improper access controls. The attack can be carried out remotely and the exploit is public.