CVE-2026-109406
5.4MediumPublished 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-840
Impact
Authenticated remote users can manipulate order pricing and potentially cause service disruption. An attacker needs a valid user account to submit tampered coupon and payment amounts during order creation.
Root cause
The mall-portal component trusts client-supplied coupon_amount and pay_amount parameters in /order/generateOrder without server-side validation.
Affected systems
macrozheng mall up to 1.0.3
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Fix & remediation
No official patched version is listed, and the vendor deleted the issue report. Inspect mall-portal's OmsPortalOrderServiceImpl to recalculate all order and coupon totals strictly on the backend, or block external access to the /order/generateOrder endpoint via your reverse proxy/WAF.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A weakness has been identified in macrozheng mall up to 1.0.3. This vulnerability affects the function OmsPortalOrderServiceImpl of the file /order/generateOrder of the component mall-portal. This manipulation of the argument coupon_amount/pay_amount causes business logic errors. The attack is possible to be carried out remotely. The vendor deleted the GitHub issue for this vulnerability without any explanation.