PT-2025-27001 · Unknown · Linlinjava Litemall

N0El4Kls · Published 2025-06-26 · Updated 2025-06-26 · CVE-2025-6702

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions: linlinjava litemall version 1.8.0

Description: A problematic issue was found in the software, affecting an unknown function of the file /wx/comment/post. The manipulation of the adminComment argument leads to improper authorization, allowing for remote attacks. The issue has been publicly disclosed.

Recommendations: For linlinjava litemall version 1.8.0, consider restricting access to the /wx/comment/post endpoint until a fix is available. As a temporary workaround, avoid using the adminComment argument in the affected endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Incorrect Authorization

Incorrect Privilege Assignment

Improper Authorization

Weakness Enumeration

CWE-863

CWE-266

CWE-285

Related Identifiers

CVE-2025-6702

Affected Products

Linlinjava Litemall

References · 9

• 🔥 https://ctf-n0el4kls.notion.site/Litemall-Mass-Assignment-Vulnerability-in-wx-comment-post-21441990f447808b86d1cb15e37ecae9?source=copy_link · Exploit
• 🔥 https://ctf-n0el4kls.notion.site/Litemall-Mass-Assignment-Vulnerability-in-wx-comment-post-21441990f447808b86d1cb15e37ecae9 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-6702 · Security Note
• https://osv.dev/vulnerability/CVE-2025-6702 · Vendor Advisory
• https://vuldb.com/?id.313968 · Note
• https://vuldb.com/?ctiid.313968 · Note
• https://t.me/cvetracker/27156 · Telegram Post
• https://vuldb.com/?submit.597473 · Note
• https://twitter.com/CVEnew/status/1938290029110956414 · Twitter Post