PT-2025-37288 · Linlinjava · Litemall

Aibot888 · Published 2025-09-12 · Updated 2025-09-12 · CVE-2025-10291

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: linlinjava litemall versions up to 1.8.0

Description: A weakness exists in linlinjava litemall up to version 1.8.0. The issue affects the WxAftersaleController function within the /wx/aftersale/cancel file. Manipulation of the ID argument can lead to improper authorization. This issue can be exploited remotely. The exploit has been made publicly available. The vendor was contacted but did not respond.

Recommendations: Versions prior to 1.8.0 should be used. As a temporary workaround, restrict access to the /wx/aftersale/cancel file to minimize the risk of exploitation.

Exploit

Fix

Improper Authorization

Incorrect Privilege Assignment

Weakness Enumeration

CWE-285

CWE-266

Related Identifiers

CVE-2025-10291

Affected Products

Litemall

References · 9

• 🔥 https://cnblogs.com/aibot/p/19063376 · Exploit
• https://osv.dev/vulnerability/CVE-2025-10291 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-10291 · Security Note
• https://twitter.com/CVEnew/status/1966393336224211420 · Twitter Post
• https://vuldb.com/?id.323717 · Note
• https://t.me/CVEtracker/32347 · Telegram Post
• https://vuldb.com/?submit.643390 · Note
• https://vuldb.com/?ctiid.323717 · Note
• https://t.me/cveNotify/135199 · Telegram Post