A race condition is present in the /order/generateOrder endpoint of the Coupon Redemption component of Macrozheng Mall. By manipulating the couponId request parameter, an attacker may cause concurrent requests to create orders that interfere with each other, potentially leading to inconsistent or duplicated coupon usage and other integrity problems. The vulnerability is reported as executable from a remote location but requires a high level of complexity and the exploitability is assessed as difficult.

Macrozheng Mall versions up to and including 1.0.3 are affected. The specific component is the Coupon Redemption module that handles order generation requests through the /order/generateOrder route.

The CVSS score of 2.3 indicates a low severity assessment, and there is no EVSS data available. The vulnerability is not listed in the CISA KEV catalog. The attack can be performed remotely, but its high complexity and difficult exploitability suggest that the likelihood of exploitation is low. Vulnerability owners should verify whether their deployed version is affected and monitor for unusual order generation activity.