TI-2026-70819 Aliases CVE-2026-108784 GHSA-wjhm-7w3j-9428

Business logic error in macrozheng mall payment endpoint

HIGH 70CWE-840Published 2026-10-12 · Updated 2026-10-14

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: —
Confidentiality · integrity · availability: None · Low · Low
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

macrozheng mall up to and including 1.0.3 is affected. A business logic error (CWE-840) in the AlipayServiceImpl.pay function of the payment endpoint lets attackers manipulate the total_amount argument. A remote attacker without privileges or user interaction can cause low integrity and availability impact. The exploit is now public and may be used.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

A vulnerability was detected in macrozheng mall up to 1.0.3. This vulnerability affects the function AlipayServiceImpl.pay of the file com/macro/mall/portal/service/impl/AlipayServiceImpl.java of the component Payment Endpoint. The manipulation of the argument total_amount results in business logic errors. The attack can be launched remotely. The exploit is now public and may be used. The patch is identified as dcaa93b3150352e5044708d7211b5bed0af4509f. A patch should be applied to remediate this issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00347 28th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
macrozheng	mall	1.0.0; 1.0.1; 1.0.2; 1.0.3	—	No fix listed	CNA

mall Vendormacrozheng Affected 1.0.0; 1.0.1; 1.0.2; 1.0.3 Fixed in — No fix listed CNA

CPE names CNA · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:macrozheng:mall::::::::	—	—	macrozheng

cpe:2.3:a:macrozheng:mall:*:*:*:*:*:*:*:* Versions — — ·macrozheng

Remediation

The sources list no fixed version for mall. The description identifies commit dcaa93b3150352e5044708d7211b5bed0af4509f as the patch and advises applying it.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Timeline

2026-10-12 Threatist record created from CVE-2026-108784
2026-10-12 Alias added: GHSA-wjhm-7w3j-9428
2026-10-12 Priority changed: MEDIUM → LOW
2026-10-15 CISA SSVC decision points changed
2026-10-15 Priority changed: LOW → HIGH

References

TI-2026-20902 macrozheng mall <= 1.0.3 Unauthenticated Password Reset via OTP Disclosure CVSS 4.0CRITICAL 9.3
TI-2024-37890 macrozheng mall-tiny 1.0.1 suffers from Insecure Permissions. CVSS 3.1HIGH 7.5
TI-2024-37892 macrozheng mall-tiny 1.0.1 is vulnerable to Incorrect Access Control. CVSS 3.1HIGH 8.8
TI-2024-37891 macrozheng mall-tiny 1.0.1 is vulnerable to Incorrect Access Control via the logout… CVSS 3.1HIGH 7.5
TI-2025-08009 macrozheng mall com.macro.mall.portal.controller UmsMemberController.java detail authorization CVSS 4.0MEDIUM 6.9
TI-2024-37893 In macrozheng mall-tiny 1.0.1, an attacker can send null data through the resource… CVSS 3.1MEDIUM 6.5

See all 32 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences