CVE-2025-13118
📋 TL;DR
This vulnerability in macrozheng mall-swarm and mall allows attackers to bypass authorization by manipulating the orderID parameter in the paySuccess function. Remote attackers can exploit this to access or modify payment-related data without proper permissions. Systems running affected versions up to 1.0.3 are vulnerable.
💻 Affected Systems
- macrozheng mall-swarm
- macrozheng mall
📦 What is this software?
Mall by Macrozheng
Mall Swarm by Macrozheng
⚠️ Risk & Real-World Impact
Worst Case
Attackers could manipulate payment statuses, modify order data, or potentially escalate privileges to access sensitive customer information or administrative functions.
Likely Case
Unauthorized viewing or modification of order payment statuses, potentially leading to fraudulent order confirmations or payment manipulation.
If Mitigated
With proper authorization controls and input validation, the vulnerability would be prevented, limiting impact to attempted but unsuccessful attacks.
🎯 Exploit Status
Exploit details are publicly available; manipulation of orderID parameter is straightforward once endpoint access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: Yes
Instructions:
No official patch available. Consider upgrading to latest version if available, or implement workarounds. Monitor vendor channels for updates.
🔧 Temporary Workarounds
Implement Authorization Check
allAdd proper authorization validation in the paySuccess function to verify user permissions before processing orderID.
Modify source code to include user authentication and authorization checks before orderID processing
Input Validation and Sanitization
allImplement strict input validation for orderID parameter to prevent unauthorized manipulation.
Add input validation logic to verify orderID format and ownership before processing
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block suspicious requests to /order/paySuccess endpoint
- Restrict network access to the vulnerable endpoint using network segmentation or access control lists
🔍 How to Verify
Check if Vulnerable:
Check application version; if running macrozheng mall or mall-swarm version 1.0.3 or earlier, system is vulnerable. Test by attempting unauthorized access to /order/paySuccess with manipulated orderID.Check Version:
Check application configuration files or deployment manifests for version informationVerify Fix Applied:
Verify that authorization checks are properly implemented in paySuccess function and that unauthorized orderID manipulation is rejected.📡 Detection & Monitoring
Log Indicators:
- Multiple failed authorization attempts on /order/paySuccess
- Unusual orderID parameter values in paySuccess requests
- Payment status changes from unexpected sources
Network Indicators:
- Unusual traffic patterns to /order/paySuccess endpoint
- Requests with manipulated orderID parameters
SIEM Query:
source="application_logs" AND (uri="/order/paySuccess" AND (status="403" OR status="200" with unusual parameters))