CVE-2025-15084
LowCVSS 3.1Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
A vulnerability in youlaitech youlai-mall 1.0.0/2.0.0 in the orderService.payOrder function leads to improper access controls. The attack can be initiated remotely but has high complexity and is difficult to exploit. The exploit is publicly available and the vendor has not responded.
Risk Assessment
Risk of unauthorized access to payment functions, potentially leading to order manipulation or transaction integrity issues.
Recommendation
Upgrade youlai-mall to the latest version or implement proper access controls in the payOrder function.
Other vulnerabilities in youlai-mall
See all- CVE-2026-110613Medium
youlai-mall through commit 9f62de8 contains a missing authorization vulnerability that allows authenticated members to view every customer's orders via the app order list endpoint. Attackers can page through the oms_order table using a self-registered account to read order ids, order_sn values, member ids, payment amounts, and order status.
- CVE-2025-15087Medium
A security vulnerability has been detected in youlai-mall 1.0.0/2.0.0 in the submitOrderPayment function of OrderController.java. Manipulation of the orderSn argument leads to improper authorization, and the attack may be launched remotely. The exploit has been disclosed publicly and may be used.
- CVE-2025-15086Medium
A weakness has been identified in youlai-mall 1.0.0/2.0.0. This impacts the function getMemberByMobile in the file mall-ums/ums-boot/src/main/java/com/youlai/mall/ums/controller/app/MemberController.java. The manipulation causes improper access controls. The attack may be initiated remotely, and the exploit has been made available to the public.
- CVE-2025-15085Medium
A security flaw has been discovered in youlai-mall versions 1.0.0 and 2.0.0 affecting the deductBalance function in MemberController.java. The manipulation results in improper authorization and can be launched remotely. The exploit has been released to the public and may be exploited.
- CVE-2025-14086Medium
A vulnerability was found in youlaitech youlai-mall 1.0.0/2.0.0 affecting the file /app-api/v1/members/openid/. Manipulation of the openid argument results in improper access controls, and the attack can be executed remotely. The exploit has been made public and could be used.
- CVE-2025-14085Medium
A vulnerability has been found in youlaitech youlai-mall 1.0.0/2.0.0. This impacts an unknown function of the file /app-api/v1/orders/. The manipulation of the argument orderId leads to improper control of dynamically-identified variables. Remote exploitation is possible and the exploit has been disclosed to the public.
- CVE-2025-14052Medium
A vulnerability has been found in youlaitech youlai-mall versions 1.0.0 and 2.0.0. The function getMemberById in /mall-ums/app-api/v1/members/ is affected. Manipulation of the argument memberId leads to improper access controls. The attack can be carried out remotely and the exploit is public.
- CVE-2025-14051Medium
A flaw has been found in youlaitech youlai-mall 1.0.0/2.0.0. Affected is the function getById/updateAddress/deleteAddress of the file /mall-ums/app-api/v1/addresses/. Executing manipulation can lead to improper control of dynamically-identified variables. The attack can be executed remotely and the exploit has been published.
Original NVD description (English source)
A vulnerability was identified in youlaitech youlai-mall 1.0.0/2.0.0. The impacted element is the function orderService.payOrder of the file mall-oms/oms-boot/src/main/java/com/youlai/mall/oms/controller/app/OrderController.java of the component Order Payment Handler. The manipulation leads to improper access controls. The attack can be initiated remotely. The attack is considered to have high complexity. The exploitability is regarded as difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS