The flaw resides in the /returnApply/create endpoint of the Portal component in macrozheng mall. Manipulating the orderId parameter lets an attacker provide arbitrary resource identifiers that have not been verified, effectively allowing unauthorized modification or deletion of resources. This improper control of resource identifiers (CWE-99) can compromise confidentiality, integrity, and availability of the affected data. It is inferred that the attack can be carried out remotely without requiring privileged credentials.

All deployments of macrozheng mall version 1.0.3 or earlier are impacted, since the issue exists in the /returnApply/create function. The vendor does not provide explicit information about later releases, so the statement that newer versions fix the issue is inferred and should be verified by inspecting release notes.

The CVSS score of 5.3 indicates moderate severity, but the low EPSS score (<1 %) suggests a modest risk of widespread exploitation in the wild. According to the description, the flaw is exploitable from a remote location by sending a crafted request to /returnApply/create with a manipulated orderId. A public exploit is available, meaning an attacker could immediately. The vulnerability is not listed in the CISA KEV catalog, implying no ongoing campaigns have been reported so far.