PT-2025-32440 · Unknown · Macrozheng Mall

N1N3B9S · Published 2025-08-09 · Updated 2025-08-12 · CVE-2025-8755

Positive Technologies (AI Summary)

CVSS v4.0

5.5

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions: macrozheng mall versions up to 1.0.3

Description: A vulnerability exists in macrozheng mall versions up to 1.0.3 due to an authorization bypass. The issue is related to the manipulation of the orderId argument within the detail function of the UmsMemberController.java file, part of the com.macro.mall.portal.controller component. The attack can be initiated remotely, and the exploit has been publicly disclosed. The vendor was contacted but did not respond.

Recommendations: Versions prior to 1.0.3 should be updated. As a temporary workaround, restrict access to the detail function of the UmsMemberController.java file until a patch is available. Avoid using the orderId argument in the affected function until the issue is resolved.

Exploit

Fix

Improper Authorization

IDOR

Weakness Enumeration

CWE-285

CWE-639

Related Identifiers

CVE-2025-8755

Affected Products

Macrozheng Mall

References · 11

• 🔥 https://github.com/N1n3b9S/cve/issues/14#issue-3269039303 · Exploit
• 🔥 https://github.com/N1n3b9S/cve/issues/14 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-8755 · Security Note
• https://osv.dev/vulnerability/CVE-2025-8755 · Vendor Advisory
• https://t.me/cveNotify/131555 · Telegram Post
• https://vuldb.com/?id.319253 · Note
• https://twitter.com/CVEnew/status/1954189857724530773 · Twitter Post
• https://vuldb.com/?ctiid.319253 · Note
• https://t.me/CVEtracker/29585 · Telegram Post
• https://vuldb.com/?submit.624046 · Note
• https://t.me/cveNotify/131842 · Telegram Post