A vulnerability has been found in macrozheng mall up to 1... · CVE-2025-9835 · GitHub Advisory Database · GitHub

A vulnerability has been found in macrozheng mall up to 1...

Moderate severity Unreviewed Published Sep 3, 2025 to the GitHub Advisory Database • Updated Sep 5, 2025

Package

No package listed— Suggest a package

Affected versions

Unknown

Patched versions

Unknown

Description

A vulnerability has been found in macrozheng mall up to 1.0.3. This affects the function cancelOrder of the file /order/cancelUserOrder. The manipulation of the argument orderId leads to authorization bypass. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

References

Published by the National Vulnerability Database

Sep 2, 2025

Published to the GitHub Advisory Database Sep 3, 2025

Last updated Sep 5, 2025

Weaknesses

CWE-285

Improper Authorization

The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. Learn more on MITRE.

CWE-863

Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions. Learn more on MITRE.