Macrozheng Mall-Swarm Improper Authorization Vulnerability in Payment Processing

An authorization bypass vulnerability has been identified in Macrozheng Mall-Swarm versions through 1.0.3. The issue resides in the 'paySuccess' function of the '/order/paySuccess' endpoint, where the 'orderID' parameter can be manipulated, leading to improper authorization. This vulnerability allows attackers to remotely interfere with order payments by using order IDs that belong to other users.

Impact

Exploitation of this vulnerability enables unauthorized users to process payments for orders that do not belong to them, causing financial loss and damaging user trust.

Reproduction

To reproduce this vulnerability, send a POST request to the '/order/paySuccess' endpoint with an 'orderID' that belongs to another user. The application will process the payment without proper authorization checks, allowing the payment to be completed for the unauthorized order.