CVE-2025-10422 Details

A critical payment vulnerability has been identified in Newbee Mall versions prior to 613a662adf1da7623ec34459bc83e3c1b12d8ce7. The issue resides in the Order Status Handler component, specifically within the paySuccess function of the /paySuccess endpoint. This vulnerability allows for improper authorization, as the endpoint directly updates order statuses based on the order ID provided in the request. Attackers can exploit this by sending crafted requests to mark orders as paid, without proper authorization checks. Additionally, this vulnerability enables horizontal privilege escalation, allowing users to modify the payment statuses of other users' orders, potentially disrupting the entire transaction system.

The payment process should be handled exclusively through trusted third-party payment provider callbacks, such as WeChat Pay or Alipay. The system must not depend on parameters sent directly from the client.