CVE-2026-108784: macrozheng mall Payment Endpoint AlipayServiceImpl.java AlipayServiceImpl.pay logic error
A vulnerability was detected in macrozheng mall up to 1.0.3. This vulnerability affects the function AlipayServiceImpl.pay of the file com/macro/mall/portal/service/impl/AlipayServiceImpl.java of the component Payment Endpoint. The manipulation of the argument totalamount results in business logic errors. The attack can be launched remotely. The exploit is now public and may be used. The patch is identified as dcaa93b3150352e5044708d7211b5bed0af4509f. A patch should be applied to remediate this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
macrozheng mallto a version that resolves this vulnerability.Patch dcaa93b3150352e5044708d7211b5bed0af4509f
Event History
Frequently Asked Questions
Which deployments are affected?
macrozheng mall versions up to 1.0.3 are affected, specifically the Payment Endpoint implementation containing AlipayServiceImpl.pay.
What does an attacker need to exploit this issue?
The issue can be exploited remotely without privileges or user interaction by manipulating the total_amount argument handled by the payment endpoint.
Is exploit code available?
Yes. The exploit is public and may be used.
What remediation is identified?
Apply the patch identified as dcaa93b3150352e5044708d7211b5bed0af4509f.