The vulnerability exists in AlipayServiceImpl.pay, where an attacker can alter the total_amount parameter. This manipulation bypasses the intended business logic, potentially allowing overpayment or underpayment, resulting in financial loss or unauthorized transactions. The flaw is a business logic error that can be exploited remotely, and the exploit is publicly available.

The affected product is macrozheng mall, version 1.0.3 and earlier. The issue is located in com/macro/mall/portal/service/impl/AlipayServiceImpl.java within the Payment Endpoint component. No other systems or versions are known to be impacted.

The CVSS score of 6.9 indicates a moderate severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector is remote and the public nature of the exploit increases the likelihood of real‑world exploitation. The lack of official remediation increases risk until a patch is applied.