CVE-2026-108784

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-108784

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108784.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-108784

Published

2026-10-12T01:00:21Z

Modified

2026-10-13T07:08:08Z

Severity

5.5 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

macrozheng mall Payment Endpoint AlipayServiceImpl.java AlipayServiceImpl.pay logic error

Details

A vulnerability was detected in macrozheng mall up to 1.0.3. This vulnerability affects the function AlipayServiceImpl.pay of the file com/macro/mall/portal/service/impl/AlipayServiceImpl.java of the component Payment Endpoint. The manipulation of the argument total_amount results in business logic errors. The attack can be launched remotely. The exploit is now public and may be used. The patch is identified as dcaa93b3150352e5044708d7211b5bed0af4509f. A patch should be applied to remediate this issue.

Database specific

{
    "cna_assigner":  "VulDB",
    "cwe_ids":  [
        "CWE-840"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-108784.json"
}

References

Affected packages

Git / github.com/macrozheng/mall

Affected ranges

Type

GIT

Repo

https://github.com/macrozheng/mall

Events

Introduced

470c40eb1656485e53fa175afd7c05d506b42e02

Fixed

dcaa93b3150352e5044708d7211b5bed0af4509f

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "1.0.0"
        },
        {
            "last_affected":  "1.0.0"
        },
        {
            "introduced":  "1.0.1"
        },
        {
            "last_affected":  "1.0.1"
        },
        {
            "introduced":  "1.0.2"
        },
        {
            "last_affected":  "1.0.2"
        },
        {
            "introduced":  "1.0.3"
        },
        {
            "last_affected":  "1.0.3"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

1.*

1.0.0

1.0.1

1.0.2

1.0.3

v1.*

v1.0.0

v1.0.1

v1.0.2

v1.0.3

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108784.json"

vanir_signatures

[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "179643456709652125297185569904800424676",
                "264207904618224348539568295985753707591",
                "30879270233365273209061935051683473795",
                "187260706500736125208286535263569701115",
                "16965134910519273684834326339623394973",
                "14272794600468852640643021967715414804",
                "170520818621640150220727518430058086848",
                "129819981967227462313874579801828658363",
                "142177108417287222380555084617530686586",
                "94610251623494947873569117293845440486"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-108784-034bb135",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/macrozheng/mall/commit/dcaa93b3150352e5044708d7211b5bed0af4509f",
        "target":  {
            "file":  "mall-portal/src/main/java/com/macro/mall/portal/service/impl/OmsPortalOrderServiceImpl.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "140856672676074081720011023288069093118",
                "61311921588696638024373971681081532511",
                "72705844914815908492924304674851184231",
                "86212090098834922957523178019328281300",
                "219606914302098797457256763306951749399",
                "49610446923158333571861480720622892801",
                "332130855564299574743275535462436440166",
                "224889746348703264411446437930599281686",
                "215722503914556987624126170697433053082",
                "233200002975973743305757457663287171013",
                "29366404070774873366856313558756210740",
                "227887969972442337512251174217202926621",
                "160095420365934946791193997597125430216",
                "215722503914556987624126170697433053082",
                "233200002975973743305757457663287171013",
                "29366404070774873366856313558756210740",
                "326534213024523978823446886807293952506",
                "66897031272714680470781209407768400874"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-108784-1893e5db",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/macrozheng/mall/commit/dcaa93b3150352e5044708d7211b5bed0af4509f",
        "target":  {
            "file":  "mall-portal/src/main/java/com/macro/mall/portal/service/impl/AlipayServiceImpl.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "282027662142645731721252105808824071208",
                "183643072123525369807080762997002883883",
                "287762359737696380349079568090657125197",
                "43949289299695804424313110398060938313"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-108784-1f609e48",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/macrozheng/mall/commit/dcaa93b3150352e5044708d7211b5bed0af4509f",
        "target":  {
            "file":  "mall-portal/src/main/java/com/macro/mall/portal/service/OmsPortalOrderService.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "181834123095728459286916895948271664159",
            "length":  727
        },
        "id":  "CVE-2026-108784-6bab5301",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/macrozheng/mall/commit/dcaa93b3150352e5044708d7211b5bed0af4509f",
        "target":  {
            "file":  "mall-portal/src/main/java/com/macro/mall/portal/service/impl/AlipayServiceImpl.java",
            "function":  "webPay"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "246389757056110067904328968425293156550",
            "length":  736
        },
        "id":  "CVE-2026-108784-8db4f871",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/macrozheng/mall/commit/dcaa93b3150352e5044708d7211b5bed0af4509f",
        "target":  {
            "file":  "mall-portal/src/main/java/com/macro/mall/portal/service/impl/AlipayServiceImpl.java",
            "function":  "pay"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "71750856364633401575120080708836087097",
            "length":  313
        },
        "id":  "CVE-2026-108784-b6a3ca7c",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/macrozheng/mall/commit/dcaa93b3150352e5044708d7211b5bed0af4509f",
        "target":  {
            "file":  "mall-portal/src/main/java/com/macro/mall/portal/service/impl/OmsPortalOrderServiceImpl.java",
            "function":  "paySuccessByOrderSn"
        }
    }
]

vanir_signatures_modified

"2026-10-13T07:08:08Z"