CVE-2025-15084: youlaitech youlai-mall Order Payment OrderController.java orderService.payOrder access control
A vulnerability was identified in youlaitech youlai-mall 1.0.0/2.0.0. The impacted element is the function orderService.payOrder of the file mall-oms/oms-boot/src/main/java/com/youlai/mall/oms/controller/app/OrderController.java of the component Order Payment Handler. The manipulation leads to improper access controls. The attack can be initiated remotely. The attack is considered to have high complexity. The exploitability is regarded as difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-15084?
The severity of CVE-2025-15084 is classified as high due to its potential impact on the order payment process.
How do I fix CVE-2025-15084?
To fix CVE-2025-15084, update the youlaitech youlai-mall software to a version after 2.0.0.
What versions of youlaitech youlai-mall are affected by CVE-2025-15084?
CVE-2025-15084 affects versions 1.0.0 through 2.0.0 of youlaitech youlai-mall.
Can CVE-2025-15084 be exploited remotely?
Yes, CVE-2025-15084 can potentially be exploited remotely through manipulation of the payment functionality.
What component is impacted by CVE-2025-15084?
CVE-2025-15084 impacts the Order Payment Handler component, specifically the orderService.payOrder function.