Description
A vulnerability has been found in macrozheng mall 1.0.3 dcaa93b. The impacted element is the function OmsOrderServiceImpl.updateMoneyInfo of the file /order/update/moneyInfo of the component mall-admin/mall-portal. The manipulation leads to incorrect calculation. The attack can be initiated remotely. The vendor deleted the GitHub issue for this vulnerability without any explanation.
Published: 2026-10-13
Score: 4.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Incorrect calculation of order monetary values leading to data integrity and potential financial loss
Action: Assess Impact
AI Analysis

Impact

A flaw in the OmsOrderServiceImpl.updateMoneyInfo method causes monetary values to be computed incorrectly, resulting in inaccurate billing or order totals. Classified as a CWE-682, an incorrect calculation weakness, this can compromise the integrity of financial data and expose an organization to potential revenue loss.

Affected Systems

The issue exists in the macrozheng mall open‑source e‑commerce platform, specifically in version 1.0.3 of the mall-admin/mall-portal components. The vulnerable function resides in /order/update/moneyInfo. No other affected products or vendors are listed.

Risk and Exploitability

The CVSS v3.1 score of 4.8 indicates moderate severity. EPSS is not available and the vulnerability is not listed in CISA’s KEV catalog, suggesting no widespread exploitation has been observed. The attack can be initiated remotely, presumably by sending a crafted request to the /order/update/moneyInfo endpoint, which may be accessible to authenticated users with permission to update orders.

Generated by OpenCVE AI on October 13, 2026 at 15:26 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Check the vendor's repository and release notes for an updated version of macrozheng mall that includes a fix to OmsOrderServiceImpl.updateMoneyInfo; upgrade if available.
  • If a patch is not yet released, add application‑level validation to the /order/update/moneyInfo endpoint that verifies monetary inputs against expected ranges or business rules before performing the calculation.
  • Restrict access to the /order/update/moneyInfo endpoint to authorized users only and enable detailed logging to detect anomalous or suspicious update attempts.

Generated by OpenCVE AI on October 13, 2026 at 15:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 17 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 13:45:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in macrozheng mall 1.0.3 dcaa93b. The impacted element is the function OmsOrderServiceImpl.updateMoneyInfo of the file /order/update/moneyInfo of the component mall-admin/mall-portal. The manipulation leads to incorrect calculation. The attack can be initiated remotely. The vendor deleted the GitHub issue for this vulnerability without any explanation.
Title macrozheng mall mall-admin/mall-portal moneyInfo OmsOrderServiceImpl.updateMoneyInfo calculation
First Time appeared Macrozheng
Macrozheng mall
Weaknesses CWE-682
CPEs cpe:2.3:a:macrozheng:mall:*:*:*:*:*:*:*:*
Vendors & Products Macrozheng
Macrozheng mall
References
Metrics cvssV2_0

{'score': 3.3, 'vector': 'AV:N/AC:L/Au:M/C:N/I:P/A:N/E:ND/RL:ND/RC:C'}

cvssV3_0

{'score': 2.4, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:X/RL:X/RC:C'}

cvssV3_1

{'score': 2.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:X/RL:X/RC:C'}

cvssV4_0

{'score': 4.8, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X'}

Subscriptions

Macrozheng Mall
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-16T21:56:30.740Z

Reserved: 2026-10-12T15:03:08.280Z

Link: CVE-2026-109410

cve-icon Vulnrichment

Updated: 2026-10-16T21:56:24.816Z

cve-icon NVD

Status : Deferred

Published: 2026-10-13T14:17:25.870

Modified: 2026-10-16T22:17:18.880

Link: CVE-2026-109410

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T15:30:08Z

Weaknesses