CVE-2025-13118: macrozheng mall-swarm/mall paySuccess improper authorization
A vulnerability was detected in macrozheng mall-swarm and mall up to 1.0.3. Affected by this issue is the function paySuccess of the file /order/paySuccess. The manipulation of the argument orderID results in improper authorization. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-13118?
CVE-2025-13118 has been classified with a severity that indicates a significant risk due to improper authorization issues.
How do I fix CVE-2025-13118?
To address CVE-2025-13118, upgrade macrozheng mall-swarm to version 1.0.4 or later, which resolves the vulnerability.
Which versions of macrozheng mall-swarm are affected by CVE-2025-13118?
Versions of macrozheng mall-swarm up to and including 1.0.3 are affected by CVE-2025-13118.
Can CVE-2025-13118 be exploited remotely?
Yes, CVE-2025-13118 can be exploited remotely, allowing attackers to manipulate orderID for unauthorized access.
What is the impact of CVE-2025-13118 on affected systems?
The impact of CVE-2025-13118 on affected systems includes the potential for unauthorized access and manipulation of order information.