Medium severity4.3NVD Advisory· Published Sep 2, 2025· Updated Apr 29, 2026
CVE-2025-9835
CVE-2025-9835
Description
A vulnerability has been found in macrozheng mall up to 1.0.3. This affects the function cancelOrder of the file /order/cancelUserOrder. The manipulation of the argument orderId leads to authorization bypass. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Affected products
2cpe:2.3:a:macrozheng:mall:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:macrozheng:mall:*:*:*:*:*:*:*:*range: <=1.0.3
- (no CPE)range: <=1.0.3
Patches
Vulnerability mechanics
References
5- github.com/ez-lbz/poc/issues/46nvdExploitIssue TrackingThird Party Advisory
- github.com/ez-lbz/poc/issues/46nvdExploitIssue TrackingThird Party Advisory
- vuldb.comnvdThird Party AdvisoryVDB Entry
- vuldb.comnvdThird Party AdvisoryVDB Entry
- vuldb.comnvdPermissions RequiredVDB Entry
News mentions
0No linked articles in our index yet.