CVE-2026-109406: macrozheng mall mall-portal generateOrder OmsPortalOrderServiceImpl logic error
A weakness has been identified in macrozheng mall up to 1.0.3. This vulnerability affects the function OmsPortalOrderServiceImpl of the file /order/generateOrder of the component mall-portal. This manipulation of the argument couponamount/payamount causes business logic errors. The attack is possible to be carried out remotely. The vendor deleted the GitHub issue for this vulnerability without any explanation.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments of macrozheng mall up to version 1.0.3 that expose the mall-portal order generation endpoint are affected. Exploitation is remote and requires low privileges.
What must an attacker be able to do?
The attacker needs access sufficient to submit a request to the /order/generateOrder functionality. They can manipulate the coupon_amount and pay_amount arguments to trigger the business logic error.
What is the potential impact?
The provided severity vector indicates integrity and availability impacts, with no stated confidentiality impact. The issue concerns order-generation payment and coupon values, so affected deployments should review order records for unexpected or inconsistent amounts.