CVE-2025-14052

youlai-mall through commit 9f62de8 contains a missing authorization vulnerability that allows authenticated members to view every customer's orders via the app order list endpoint. Attackers can page through the oms_order table using a self-registered account to read order ids, order_sn values, member ids, payment amounts, and order status.

A security vulnerability has been detected in youlai-mall 1.0.0/2.0.0 in the submitOrderPayment function of OrderController.java. Manipulation of the orderSn argument leads to improper authorization, and the attack may be launched remotely. The exploit has been disclosed publicly and may be used.

A weakness has been identified in youlai-mall 1.0.0/2.0.0. This impacts the function getMemberByMobile in the file mall-ums/ums-boot/src/main/java/com/youlai/mall/ums/controller/app/MemberController.java. The manipulation causes improper access controls. The attack may be initiated remotely, and the exploit has been made available to the public.

A security flaw has been discovered in youlai-mall versions 1.0.0 and 2.0.0 affecting the deductBalance function in MemberController.java. The manipulation results in improper authorization and can be launched remotely. The exploit has been released to the public and may be exploited.

A vulnerability in youlaitech youlai-mall 1.0.0/2.0.0 in the orderService.payOrder function leads to improper access controls. The attack can be initiated remotely but has high complexity and is difficult to exploit. The exploit is publicly available and the vendor has not responded.

A vulnerability was found in youlaitech youlai-mall 1.0.0/2.0.0 affecting the file /app-api/v1/members/openid/. Manipulation of the openid argument results in improper access controls, and the attack can be executed remotely. The exploit has been made public and could be used.

A vulnerability has been found in youlaitech youlai-mall 1.0.0/2.0.0. This impacts an unknown function of the file /app-api/v1/orders/. The manipulation of the argument orderId leads to improper control of dynamically-identified variables. Remote exploitation is possible and the exploit has been disclosed to the public.

A flaw has been found in youlaitech youlai-mall 1.0.0/2.0.0. Affected is the function getById/updateAddress/deleteAddress of the file /mall-ums/app-api/v1/addresses/. Executing manipulation can lead to improper control of dynamically-identified variables. The attack can be executed remotely and the exploit has been published.