PT-2025-6861 · Ywoa · Ywoa

Rabbit · Published 2025-02-12 · Updated 2025-06-05 · CVE-2025-1225

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ywoa versions 2024.07.03 and earlier

Description A problematic issue has been found in the function extract of the file c-main/src/main/java/com/redmoon/weixin/aes/XMLParse.java of the component WXCallBack Interface. The manipulation leads to an xml external entity reference. The attack may be initiated remotely.

Recommendations For ywoa versions 2024.07.03 and earlier, upgrade to version 2024.07.04 to address this issue. As a temporary workaround, consider disabling the extract function of the WXCallBack Interface component until the update is applied. Restrict access to the XMLParse.java file to minimize the risk of exploitation.

Exploit

Fix

XXE

Weakness Enumeration

CWE-610

CWE-611

Related Identifiers

CVE-2025-1225

Affected Products

Ywoa

References · 8

• 🔥 https://gitee.com/r1bbit/yimioa/issues/IBI81R · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-1225 · Security Note
• https://osv.dev/vulnerability/CVE-2025-1225 · Vendor Advisory
• https://t.me/cvenotify/124811 · Telegram Post
• https://vuldb.com/?ctiid.295211 · Note
• https://twitter.com/CVEnew/status/1889784909147128056 · Twitter Post
• https://vuldb.com/?id.295211 · Note
• https://t.me/cvedetector/17923 · Telegram Post