PT-2025-53414 · Youlaitech · Youlai-Mall

Huangweigang + 1 · Published 2025-12-25 · Updated 2026-02-26 · CVE-2025-15087

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions youlaitech youlai-mall versions 1.0.0 through 2.0.0

Description A security issue has been identified in youlaitech youlai-mall. Manipulation of the orderSn argument within the submitOrderPayment function, located in the file mall-oms/oms-boot/src/main/java/com/youlai/mall/oms/controller/app/OrderController.java, can lead to improper authorization. This issue may be exploited remotely. The exploit for this issue has been publicly disclosed. The existence of this issue is currently questioned, and the vendor has not responded to reports about it.

Recommendations youlaitech youlai-mall versions 1.0.0 through 2.0.0: Address improper authorization by securing the submitOrderPayment function and validating the orderSn argument.

Exploit

Fix

Improper Authorization

Incorrect Privilege Assignment

Weakness Enumeration

CWE-285

CWE-266

Related Identifiers

CVE-2025-15087

Affected Products

Youlai-Mall

References · 11

• 🔥 https://github.com/Hwwg/cve/issues/30 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-15087 · Security Note
• https://osv.dev/vulnerability/CVE-2025-15087 · Vendor Advisory
• https://t.me/cveNotify/146836 · Telegram Post
• https://twitter.com/CVEnew/status/2004457750336819664 · Twitter Post
• https://t.me/CVEtracker/40671 · Telegram Post
• https://vuldb.com/?submit.708180 · Note
• https://vuldb.com/?id.338415 · Note
• https://vuldb.com/?ctiid.338415 · Note
• https://t.me/cveNotify/153338 · Telegram Post
• https://t.me/cveNotify/147394 · Telegram Post