macrozheng mall Member Endpoint update improper authorization

A security vulnerability has been detected in macrozheng mall up to 1.0.3. This vulnerability affects unknown code of the file /member/address/update/ of the component Member Endpoint. The manipulation leads to improper authorization. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.

Problem type

Affected products

macrozheng

mall

1.0.0 - AFFECTED

1.0.1 - AFFECTED

1.0.2 - AFFECTED

1.0.3 - AFFECTED

References

VDB-338496 | macrozheng mall Member Endpoint update improper authorization

https://vuldb.com/?id.338496

vdb-entry

VDB-338496 | CTI Indicators (IOB, IOC, TTP, IOA)

https://vuldb.com/?ctiid.338496

signaturepermissions-required

Submit #711758 | mall latest Improper Control of Resource Identifiers

https://vuldb.com/?submit.711758

third-party-advisory

github.com

https://github.com/Hwwg/cve/issues/31

exploitissue-tracking

JSON source

https://cveawg.mitre.org/api/cve/CVE-2025-15118

Click to expand

{
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "cveMetadata": {
    "cveId": "CVE-2025-15118",
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "dateUpdated": "2025-12-28T03:02:05.540Z",
    "dateReserved": "2025-12-27T08:48:43.979Z",
    "datePublished": "2025-12-28T03:02:05.540Z",
    "state": "PUBLISHED"
  },
  "containers": {
    "cna": {
      "providerMetadata": {
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB",
        "dateUpdated": "2025-12-28T03:02:05.540Z"
      },
      "title": "macrozheng mall Member Endpoint update improper authorization",
      "descriptions": [
        {
          "lang": "en",
          "value": "A security vulnerability has been detected in macrozheng mall up to 1.0.3. This vulnerability affects unknown code of the file /member/address/update/ of the component Member Endpoint. The manipulation leads to improper authorization. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used."
        }
      ],
      "affected": [
        {
          "vendor": "macrozheng",
          "product": "mall",
          "modules": [
            "Member Endpoint"
          ],
          "versions": [
            {
              "version": "1.0.0",
              "status": "affected"
            },
            {
              "version": "1.0.1",
              "status": "affected"
            },
            {
              "version": "1.0.2",
              "status": "affected"
            },
            {
              "version": "1.0.3",
              "status": "affected"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "lang": "en",
              "description": "Improper Authorization",
              "cweId": "CWE-285",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "lang": "en",
              "description": "Incorrect Privilege Assignment",
              "cweId": "CWE-266",
              "type": "CWE"
            }
          ]
        }
      ],
      "references": [
        {
          "url": "https://vuldb.com/?id.338496",
          "name": "VDB-338496 | macrozheng mall Member Endpoint update improper authorization",
          "tags": [
            "vdb-entry"
          ]
        },
        {
          "url": "https://vuldb.com/?ctiid.338496",
          "name": "VDB-338496 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ]
        },
        {
          "url": "https://vuldb.com/?submit.711758",
          "name": "Submit #711758 | mall latest Improper Control of Resource Identifiers",
          "tags": [
            "third-party-advisory"
          ]
        },
        {
          "url": "https://github.com/Hwwg/cve/issues/31",
          "tags": [
            "exploit",
            "issue-tracking"
          ]
        }
      ],
      "metrics": [
        {},
        {
          "cvssV3_1": {
            "version": "3.1",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM"
          }
        },
        {
          "cvssV3_0": {
            "version": "3.0",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM"
          }
        },
        {
          "cvssV2_0": {
            "version": "2.0",
            "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR",
            "baseScore": 4
          }
        }
      ],
      "timeline": [
        {
          "time": "2025-12-27T00:00:00.000Z",
          "lang": "en",
          "value": "Advisory disclosed"
        },
        {
          "time": "2025-12-27T01:00:00.000Z",
          "lang": "en",
          "value": "VulDB entry created"
        },
        {
          "time": "2025-12-27T09:53:52.000Z",
          "lang": "en",
          "value": "VulDB entry last update"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "huangweigang (VulDB User)",
          "type": "reporter"
        }
      ]
    }
  }
}