CVE-2025-9836 MEDIUM

CVE-2025-9836: macrozheng mall paySuccess authorization

Vendor Macrozheng
Product mall
Weakness CWE-639 · IDOR
Published September 2, 2025
Last update September 3, 2025
View on NVD All CVEs

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P

What the vulnerability does

01Description

A vulnerability was found in macrozheng mall up to 1.0.3. This vulnerability affects the function paySuccess of the file /order/paySuccess. The manipulation of the argument orderId results in authorization bypass. The attack can be launched remotely. The exploit has been made public and could be used.

Key dates

02Disclosure timeline

September 2, 2025 CVE published
September 3, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-25497 Craft has a GraphQL Asset Mutation Privilege Escalation CVE-2025-3519 Replace uploaded files knowing the file upload ID CVE-2024-9215 Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors <= 4.7.1 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary User Email Update and Account Takeover CVE-2026-48599 Authorization bypass via path binding override in elixir-grpc/grpc HTTP transcoding CVE-2026-5652 Authorization Bypass Through User-Controlled Key in Crafty Controller