CVE-2025-15084 | youlaitech youlai-mall 1.0.0/2.0.0 Order Payment OrderController.java orderService.payOrder access control

A vulnerability has been found in youlaitech youlai-mall 1.0.0/2.0.0 and classified as critical. The impacted element is the function orderService.payOrder of the file mall-oms/oms-boot/src/main/java/com/youlai/mall/oms/controller/app/OrderController.java of the component Order Payment Handler. The manipulation leads to improper access controls.

This vulnerability is documented as CVE-2025-15084. The attack can be initiated remotely. Additionally, an exploit exists.

The vendor was contacted early about this disclosure but did not respond in any way.