PT-2025-33423 · Linlinjava · Litemall

Zast.Ai · Published 2025-08-15 · Updated 2025-08-15 · CVE-2025-8991

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions: linlinjava litemall versions up to 1.8.0

Description: A vulnerability was identified in linlinjava litemall. The issue affects an unknown functionality within the /admin/config/express file of the Business Logic Handler component. Manipulation of the litemall express freight min argument leads to business logic errors. The attack can be launched remotely, and the exploit has been publicly disclosed.

Recommendations: Versions prior to 1.8.1 are affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Weakness Enumeration

CWE-840

Related Identifiers

CVE-2025-8991

Affected Products

Litemall

References · 10

• 🔥 https://github.com/linlinjava/litemall/issues/566#issue-3267858791 · Exploit
• https://github.com/linlinjava/litemall/issues/566 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-8991 · Security Note
• https://osv.dev/vulnerability/CVE-2025-8991 · Vendor Advisory
• https://t.me/CVEtracker/30065 · Telegram Post
• https://twitter.com/CVEnew/status/1956289053349044727 · Twitter Post
• https://vuldb.com/?id.319987 · Note
• https://vuldb.com/?ctiid.319987 · Note
• https://t.me/cveNotify/132383 · Telegram Post
• https://vuldb.com/?submit.628764 · Note