CVE-2025-9836 Details

A critical authorization bypass vulnerability has been identified in macrozheng mall versions through 1.0.3. The issue resides in the paySuccess function of the /order/paySuccess endpoint, where the orderId parameter can be manipulated without proper validation. This flaw allows attackers to mark any order as paid, facilitating unauthorized purchases. Additionally, the vulnerability enables horizontal privilege escalation, as users can alter the payment status of other orders by changing order IDs. This could disrupt the platform's transaction system and cause significant financial losses.

Implement validation in the paySuccess method to ensure that payment statuses can only be updated for orders belonging to the user making the request.