The flaw is in the OmsCartItemServiceImpl.updateQuantity endpoint of macrozheng mall. Supplying an altered quantity value causes a logic error that lets the requester change the cart quantity without proper validation. The result is a business‑logic failure that can affect inventory or billing accuracy.

All installations of macrozheng mall releases up to and including 1.0.3 are vulnerable. The flaw is in the /cart/update/quantity endpoint and applies to every deployment that has not upgraded beyond version 1.0.3.

The CVSS score is 5.3, indicating moderate severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, so no widespread exploitation is known. Because the endpoint can be invoked remotely through HTTP, the attacker only needs network access to the service; the required payload is the modified quantity parameter. The remote nature of the trigger is stated in the description, and the ease of sending an HTTP request is inferred from typical web service behavior.