This vulnerability affects the macrozheng mall-swarm product up to version 1.0.3. The issue lies in the paySuccess function within the /order/paySuccess endpoint, where improper authorization occurs due to insufficient validation of the orderID parameter. An attacker can remotely manipulate this argument to bypass authorization controls. The vulnerability has a CVSS 4.0 base score of 5.3, indicating a medium severity level. The vendor has not provided a patch or response, and no official remediation guidance is available.

Successful exploitation of this vulnerability could allow an attacker to perform unauthorized operations related to payment confirmation or order processing within the affected application. This could lead to unauthorized financial transactions or manipulation of order states. However, the impact is limited by the medium severity rating and the requirement for remote access to the vulnerable function. There are no confirmed reports of exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch is available, organizations should consider implementing compensating controls such as restricting access to the /order/paySuccess endpoint, validating orderID parameters rigorously, and monitoring for suspicious activity related to payment processing. Stay alert for any future vendor advisories or patches addressing this issue.