PT-2025-45162 · Unknown · Xiaozhangbang Voluntary Like System

Published 2025-11-05 · Updated 2026-01-09 · CVE-2025-60784

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions XiaozhangBang Voluntary Like System version 8.8

Description A flaw exists in the XiaozhangBang Voluntary Like System version 8.8 that allows remote attackers to manipulate the zhekou parameter within the /topfirst.php Pay module. By sending a specially crafted HTTP POST request with zhekou set to a low value, an attacker can acquire votes at a reduced price. Modifying the zid parameter allows attackers to affect purchases made by other users, increasing the impact. This is due to inadequate server-side validation of these parameters, potentially resulting in financial loss and manipulation of vote totals. The vulnerable API endpoint is /topfirst.php.

Recommendations Versions prior to 8.8 should be used.

Exploit

Fix

RCE

Improper Access Control

Improper Authorization

Weakness Enumeration

CWE-284

CWE-285

Related Identifiers

CVE-2025-60784

Affected Products

Xiaozhangbang Voluntary Like System

References · 6

• 🔥 https://github.com/GoogTech/CVE/blob/master/Incorrect%20Access%20Control/Incorrect-Access-Control-in-XiaozhangBang-Voluntary-Like-System-V8.8.md · Exploit
• 🔥 https://github.com/GoogTech/CVE/blob/master/Incorrect-Access-Control-in-XiaozhangBang-Voluntary-Like-System-V8.8.md · Exploit
• https://osv.dev/vulnerability/CVE-2025-60784 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-60784 · Security Note
• https://t.me/CVEtracker/36649 · Telegram Post
• https://t.me/cveNotify/148265 · Telegram Post