PT-2025-37285 · Unknown · Roncoo-Pay

Aibot888 · Published 2025-09-12 · Updated 2025-09-12 · CVE-2025-10287

Positive Technologies (AI Summary)

CVSS v3.1

3.1

Low

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: roncoo-pay versions prior to 9428382af21cd5568319eae7429b7e1d0332ff40

Description: A vulnerability exists in roncoo-pay that allows for direct request manipulation. The issue is related to the /auth/orderQuery file and an unknown function within it. Exploitation involves manipulating the orderNo argument. The attack can be performed remotely and is considered difficult to exploit. The exploit has been publicly disclosed.

Recommendations: Update roncoo-pay to a version prior to 9428382af21cd5568319eae7429b7e1d0332ff40.

Exploit

Fix

Weakness Enumeration

CWE-425

Related Identifiers

CVE-2025-10287

Affected Products

Roncoo-Pay

References · 7

• 🔥 https://cnblogs.com/aibot/p/19063496 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-10287 · Security Note
• https://twitter.com/CVEnew/status/1966363793820188847 · Twitter Post
• https://vuldb.com/?submit.643387 · Note
• https://vuldb.com/?id.323649 · Note
• https://vuldb.com/?ctiid.323649 · Note
• https://t.me/cveNotify/135196 · Telegram Post