The vulnerability stems from an integer overflow in the CartServiceImpl component of the qiujie mall-server application. Adjusting a cart quantity can wrap the value to a negative number. The order creation flow blindly accepts this result and passes it to the stock update query. Therefore, authenticated users can forge orders that increase inventory levels and store negative‑quantity orders, leading to counterfeit stock and distorted financial reporting.

The flaw is present in the qiujie mall-server version 0.0.1‑SNAPSHOT, a publicly available project hosted on GitHub. No vendor or CNA product name is listed, so any deployment of this snapshot that exposes the CartServiceImpl is affected. Operations running older or patched builds are not impacted, provided the overflow has been corrected.

Exploitation requires a valid authenticated session, so an attacker must own or compromise a user account. No public exploit code is known and the vulnerability is not listed in the CISA KEV catalog. With no EPSS score, the risk is assessed as high for environments where accurate inventory counts are critical. The lack of a public fix or workaround means the only reliable mitigation is to block the vulnerable code path and enforce strict quantity validation before orders are processed.