Description
Waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to forge orders by calling the internal /callback/order/submit message-queue callback. Attackers can supply arbitrary userId, addressId and cart ids in the order JSON to create orders for any member, expose stored shipping details, clear carts, and decrement stock.
References6
- github.com/wayn111/waynboot-mall/blob/v2.0.0/waynboot-common/sr…
- github.com/wayn111/waynboot-mall/blob/v2.0.0/waynboot-mobile-ap…
- github.com/wayn111/waynboot-mall/blob/v2.0.0/waynboot-mobile-ap…
- hackmd.io/@hieuPenguinnn/waynboot-mall-unauth-callback-order-fo…
- www.vulncheck.com/advisories/waynboot-mall-through-2.0.0-unauth…
- hackmd.io/@hieuPenguinnn/waynboot-mall-unauth-callback-order-fo…
Metrics
- CVSS 3.1
-
6.5
MEDIUM
Score source: CNA
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - CVSS 4.0
-
6.9
MEDIUM
Score source: CNA
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - EPSS — exploit probability
- 0% percentile: 35 · as of 10 November 2026
- CWE
- CWE-306
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.