CVE-2025-8755

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-8755
A vulnerability was found in macrozheng mall up to 1.0.3 and classified as problematic. This issue affects the function detail of the file UmsMemberController.java of the component com.macro.mall.portal.controller. The manipulation of the argument orderId leads to authorization bypass. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

5.0 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References
Link Resource
https://github.com/N1n3b9S/cve/issues/14 Exploit Issue Tracking Third Party Advisory
https://github.com/N1n3b9S/cve/issues/14#issue-3269039303 Exploit Issue Tracking Third Party Advisory
https://vuldb.com/?ctiid.319253 Permissions Required VDB Entry
https://vuldb.com/?id.319253 Third Party Advisory VDB Entry
https://vuldb.com/?submit.624046 Third Party Advisory VDB Entry
https://github.com/N1n3b9S/cve/issues/14 Exploit Issue Tracking Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:macrozheng:mall:*:*:*:*:*:*:*:*
History

02 Sep 2025, 19:23

Type Values Removed Values Added
CPE cpe:2.3:a:macrozheng:mall:*:*:*:*:*:*:*:*
References () https://github.com/N1n3b9S/cve/issues/14 - () https://github.com/N1n3b9S/cve/issues/14 - Exploit, Issue Tracking, Third Party Advisory
References () https://github.com/N1n3b9S/cve/issues/14#issue-3269039303 - () https://github.com/N1n3b9S/cve/issues/14#issue-3269039303 - Exploit, Issue Tracking, Third Party Advisory
References () https://vuldb.com/?ctiid.319253 - () https://vuldb.com/?ctiid.319253 - Permissions Required, VDB Entry
References () https://vuldb.com/?id.319253 - () https://vuldb.com/?id.319253 - Third Party Advisory, VDB Entry
References () https://vuldb.com/?submit.624046 - () https://vuldb.com/?submit.624046 - Third Party Advisory, VDB Entry
First Time Macrozheng
Macrozheng mall

12 Aug 2025, 16:15

Type Values Removed Values Added
References () https://github.com/N1n3b9S/cve/issues/14 - () https://github.com/N1n3b9S/cve/issues/14 -

11 Aug 2025, 18:32

Type Values Removed Values Added
Summary
  • (es) Se encontró una vulnerabilidad en macrozheng mall hasta la versión 1.0.3, clasificada como problemática. Este problema afecta el detalle de la función del archivo UmsMemberController.java del componente com.macro.mall.portal.controller. La manipulación del argumento orderId permite eludir la autorización. El ataque puede iniciarse en remoto. Se ha hecho público el exploit y puede que sea utilizado. Se contactó al proveedor con antelación sobre esta divulgación, pero no respondió.

09 Aug 2025, 14:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-08-09 14:15

Updated : 2025-09-02 19:23

NVD link : CVE-2025-8755

Mitre link : CVE-2025-8755

CVE.ORG link : CVE-2025-8755

JSON object : View

Products Affected

macrozheng

  • mall
CWE
CWE-285

Improper Authorization

CWE-639

Authorization Bypass Through User-Controlled Key