Vulnerability in wayn111 waynboot-mall

[ Why it matters ]Priority signals

• Public proof-of-concept exploit exists (CISA SSVC)

[ Description ]Official description

Waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to forge orders by calling the internal /callback/order/submit message-queue callback. Attackers can supply arbitrary userId, addressId and cart ids in the order JSON to create orders for any member, expose stored shipping details, clear carts, and decrement stock.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

• github.com/wayn111/waynboot-mall/blob/v2.0.0/waynboot-common/src/main/java/com/wayn/com…
• github.com/wayn111/waynboot-mall/blob/v2.0.0/waynboot-mobile-api/src/main/java/com/wayn…
• github.com/wayn111/waynboot-mall/blob/v2.0.0/waynboot-mobile-api/src/main/java/com/wayn…
• hackmd.io/@hieuPenguinnn/waynboot-mall-unauth-callback-order-forgery-cancel-mail-relay
• www.vulncheck.com/advisories/waynboot-mall-through-2.0.0-unauthenticated-order-forgery-…