CVE-2026-105573: Business Logic Errors in newbee-ltd newbee-mall

This vulnerability affects newbee-ltd newbee-mall up to version 2.7.5 in the Shopping Cart Quantity Handler component, specifically in the /jshERP-boot/accountHead/updateAccountHeadAndDetail function. Manipulating the goodsCount argument leads to business logic errors, which could be exploited remotely. The vulnerability has a CVSS 4.0 base score of 5.3 (medium severity), indicating moderate impact with low attack complexity and no required privileges or user interaction. The vendor has been informed but has not responded or provided a patch. Public exploit code is available, increasing the risk of exploitation.

Exploitation of this vulnerability can cause business logic errors in the affected component, potentially leading to incorrect handling of shopping cart quantities. This could affect transaction integrity or business processes relying on accurate quantity data. The vulnerability can be triggered remotely without authentication or user interaction, increasing exposure. However, no confirmed active exploitation in the wild has been reported.

No official fix or patch is currently available from the vendor. Since the vendor has not responded or issued remediation guidance, users should monitor vendor advisories for updates. Until a patch is released, consider implementing application-level input validation or restricting access to the vulnerable function if possible to mitigate risk.