{"id":"CVE-2026-108784","summary":"macrozheng mall Payment Endpoint AlipayServiceImpl.java AlipayServiceImpl.pay logic error","details":"A vulnerability was detected in macrozheng mall up to 1.0.3. This vulnerability affects the function AlipayServiceImpl.pay of the file com/macro/mall/portal/service/impl/AlipayServiceImpl.java of the component Payment Endpoint. The manipulation of the argument total_amount results in business logic errors. The attack can be launched remotely. The exploit is now public and may be used. The patch is identified as dcaa93b3150352e5044708d7211b5bed0af4509f. A patch should be applied to remediate this issue.","modified":"2026-10-13T07:08:08.175951267Z","published":"2026-10-12T01:00:21.032Z","database_specific":{"cwe_ids":["CWE-840"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-108784.json","cna_assigner":"VulDB"},"references":[{"type":"WEB","url":"https://github.com/macrozheng/mall/"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-108784.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108784"},{"type":"ADVISORY","url":"https://vuldb.com/cve/CVE-2026-108784"},{"type":"ADVISORY","url":"https://vuldb.com/submit/959283"},{"type":"ADVISORY","url":"https://vuldb.com/vuln/416563"},{"type":"REPORT","url":"https://github.com/macrozheng/mall/issues/998"},{"type":"REPORT","url":"https://vuldb.com/vuln/416563/cti"},{"type":"FIX","url":"https://github.com/macrozheng/mall/commit/dcaa93b3150352e5044708d7211b5bed0af4509f"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/macrozheng/mall","events":[{"introduced":"470c40eb1656485e53fa175afd7c05d506b42e02"},{"fixed":"dcaa93b3150352e5044708d7211b5bed0af4509f"}],"database_specific":{"source":["AFFECTED_FIELD","REFERENCES"],"extracted_events":[{"introduced":"1.0.0"},{"last_affected":"1.0.0"},{"introduced":"1.0.1"},{"last_affected":"1.0.1"},{"introduced":"1.0.2"},{"last_affected":"1.0.2"},{"introduced":"1.0.3"},{"last_affected":"1.0.3"}]}}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3","v1.0.3","v1.0.2","v1.0.1","v1.0.0"],"database_specific":{"vanir_signatures":[{"digest":{"threshold":0.9,"line_hashes":["179643456709652125297185569904800424676","264207904618224348539568295985753707591","30879270233365273209061935051683473795","187260706500736125208286535263569701115","16965134910519273684834326339623394973","14272794600468852640643021967715414804","170520818621640150220727518430058086848","129819981967227462313874579801828658363","142177108417287222380555084617530686586","94610251623494947873569117293845440486"]},"id":"CVE-2026-108784-034bb135","signature_type":"Line","signature_version":"v1","source":"https://github.com/macrozheng/mall/commit/dcaa93b3150352e5044708d7211b5bed0af4509f","target":{"file":"mall-portal/src/main/java/com/macro/mall/portal/service/impl/OmsPortalOrderServiceImpl.java"},"deprecated":false},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["140856672676074081720011023288069093118","61311921588696638024373971681081532511","72705844914815908492924304674851184231","86212090098834922957523178019328281300","219606914302098797457256763306951749399","49610446923158333571861480720622892801","332130855564299574743275535462436440166","224889746348703264411446437930599281686","215722503914556987624126170697433053082","233200002975973743305757457663287171013","29366404070774873366856313558756210740","227887969972442337512251174217202926621","160095420365934946791193997597125430216","215722503914556987624126170697433053082","233200002975973743305757457663287171013","29366404070774873366856313558756210740","326534213024523978823446886807293952506","66897031272714680470781209407768400874"]},"id":"CVE-2026-108784-1893e5db","signature_type":"Line","signature_version":"v1","source":"https://github.com/macrozheng/mall/commit/dcaa93b3150352e5044708d7211b5bed0af4509f","target":{"file":"mall-portal/src/main/java/com/macro/mall/portal/service/impl/AlipayServiceImpl.java"}},{"digest":{"line_hashes":["282027662142645731721252105808824071208","183643072123525369807080762997002883883","287762359737696380349079568090657125197","43949289299695804424313110398060938313"],"threshold":0.9},"id":"CVE-2026-108784-1f609e48","signature_type":"Line","signature_version":"v1","source":"https://github.com/macrozheng/mall/commit/dcaa93b3150352e5044708d7211b5bed0af4509f","target":{"file":"mall-portal/src/main/java/com/macro/mall/portal/service/OmsPortalOrderService.java"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/macrozheng/mall/commit/dcaa93b3150352e5044708d7211b5bed0af4509f","target":{"file":"mall-portal/src/main/java/com/macro/mall/portal/service/impl/AlipayServiceImpl.java","function":"webPay"},"deprecated":false,"digest":{"function_hash":"181834123095728459286916895948271664159","length":727},"id":"CVE-2026-108784-6bab5301","signature_type":"Function"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/macrozheng/mall/commit/dcaa93b3150352e5044708d7211b5bed0af4509f","target":{"function":"pay","file":"mall-portal/src/main/java/com/macro/mall/portal/service/impl/AlipayServiceImpl.java"},"deprecated":false,"digest":{"function_hash":"246389757056110067904328968425293156550","length":736},"id":"CVE-2026-108784-8db4f871"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/macrozheng/mall/commit/dcaa93b3150352e5044708d7211b5bed0af4509f","target":{"function":"paySuccessByOrderSn","file":"mall-portal/src/main/java/com/macro/mall/portal/service/impl/OmsPortalOrderServiceImpl.java"},"deprecated":false,"digest":{"function_hash":"71750856364633401575120080708836087097","length":313},"id":"CVE-2026-108784-b6a3ca7c"}],"vanir_signatures_modified":"2026-10-13T07:08:08Z","source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108784.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}]}