CVE-2026-108784

6.5Medium

Published 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

6.5Medium

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: Limited impact
Weakness: CWE-840

Impact

Remote unauthenticated attackers can alter order payment amounts to trigger business logic errors. Exploitation requires only network access to the Alipay payment endpoint.

Root cause

The AlipayServiceImpl.pay method fails to properly validate the total_amount parameter, allowing arbitrary manipulation of payment totals.

Affected systems

macrozheng mall up to 1.0.3

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Fix & remediation

Apply commit dcaa93b3150352e5044708d7211b5bed0af4509f to the repository and redeploy the service. If you cannot patch immediately, block or filter external requests to the payment endpoint that contain tampered total_amount values.

shell

$ git cherry-pick dcaa93b3150352e5044708d7211b5bed0af4509f

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

A vulnerability was detected in macrozheng mall up to 1.0.3. This vulnerability affects the function AlipayServiceImpl.pay of the file com/macro/mall/portal/service/impl/AlipayServiceImpl.java of the component Payment Endpoint. The manipulation of the argument total_amount results in business logic errors. The attack can be launched remotely. The exploit is now public and may be used. The patch is identified as dcaa93b3150352e5044708d7211b5bed0af4509f. A patch should be applied to remediate this issue.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-108784