PT-2025-22851 · Unknown · Tmall Demo

Baihekuz · Published 2025-05-24 · Updated 2025-05-25 · CVE-2025-5136

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Tmall Demo up to 20250505

Description A vulnerability was found in Tmall Demo, affecting an unknown part of the file /tmall/order/pay/ of the component Payment Identifier Handler. The manipulation leads to insufficiently random values. It is possible to initiate the attack remotely. The complexity of an attack is rather high, and the exploitability is difficult. The exploit has been disclosed to the public and may be used.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Use of Insufficiently Random Values

Weakness Enumeration

CWE-310

CWE-330

Related Identifiers

CVE-2025-5136

Affected Products

Tmall Demo

References · 10

• 🔥 https://github.com/bdkuzma/vuln/issues/15 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-5136 · Security Note
• https://osv.dev/vulnerability/CVE-2025-5136 · Vendor Advisory
• https://t.me/cvenotify/123548 · Telegram Post
• https://twitter.com/CVEnew/status/1926606809520914564 · Twitter Post
• https://vuldb.com/?id.310215 · Note
• https://twitter.com/VulmonFeeds/status/1926441284064985582 · Twitter Post
• https://vuldb.com/?ctiid.310215 · Note
• https://t.me/cvetracker/24589 · Telegram Post
• https://vuldb.com/?submit.571960 · Note