A flaw exists within the Super Admin Password Handler component of macrozheng mall that permits improper authorization. By triggering a manipulation of the /admin/update endpoint, an unauthenticated or low‑privileged attacker can override the password of a super‑admin account. This grants full control over the application, allowing the attacker to modify configuration, view sensitive data, or launch further attacks. The vulnerability is categorized as both CWE‑266 (Improper Handling of Privilege Escalation) and CWE‑285 (Improper Authorization).

The affected product is macrozheng mall, versions up to 1.0.3. The issue specifically lies in an undisclosed function within the /admin/update file of the Super Admin Password Handler module. No patches or updates are currently available from the vendor, and the issue tracker has been removed without explanation.

With a CVSS score of 5.1 the vulnerability is considered of moderate severity. The EPSS score is not available, and it is not listed in the CISA KEV catalog, indicating limited public exploitation data. Nevertheless, the remote exploitation path is straightforward: an attacker can send a crafted request to /admin/update and bypass authentication checks. The lack of an official workaround or fix underscores the need for mitigation measures until a vendor update is released.