CVE-2026-109406
Deferred Deferred - Pending Action

Remote Code Execution in MacroZheng Mall

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: VulDB

Description
A weakness has been identified in macrozheng mall up to 1.0.3. This vulnerability affects the function OmsPortalOrderServiceImpl of the file /order/generateOrder of the component mall-portal. This manipulation of the argument coupon_amount/pay_amount causes business logic errors. The attack is possible to be carried out remotely. The vendor deleted the GitHub issue for this vulnerability without any explanation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-109406
EUVD
EUVD-2026-98551

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
macrozheng mall 1.0.0
macrozheng mall 1.0.1
macrozheng mall 1.0.2
macrozheng mall 1.0.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-840 Business Logic Errors

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in macrozheng mall up to version 1.0.3. It involves the function OmsPortalOrderServiceImpl in the file /order/generateOrder of the mall-portal component. The issue allows manipulation of the coupon_amount or pay_amount arguments, leading to business logic errors. The attack can be executed remotely.

Impact Analysis

This vulnerability could allow attackers to manipulate order amounts or coupon values, potentially leading to financial losses or unauthorized discounts. It may also disrupt normal business operations by causing incorrect order processing or financial discrepancies.

Mitigation Strategies

Immediately upgrade macrozheng mall to a version beyond 1.0.3 where this issue is resolved. If no patch is available, disable the affected component /order/generateOrder or restrict access to the OmsPortalOrderServiceImpl function to prevent remote exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109406. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart