CVE-2025-10291: linlinjava litemall cancel WxAftersaleController improper authorization
A weakness has been identified in linlinjava litemall up to 1.8.0. This affects the function WxAftersaleController of the file /wx/aftersale/cancel. Executing manipulation of the argument ID can lead to improper authorization. The attack can be executed remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-10291?
CVE-2025-10291 is considered a high severity vulnerability due to the potential for remote unauthorized access.
How do I fix CVE-2025-10291?
To fix CVE-2025-10291, upgrade linlinjava litemall to a version higher than 1.8.0.
What impact does CVE-2025-10291 have on my system?
CVE-2025-10291 can allow an attacker to execute unauthorized actions by manipulating the argument ID in the WxAftersaleController.
Can CVE-2025-10291 be exploited remotely?
Yes, CVE-2025-10291 can be exploited remotely, allowing attackers to manipulate requests to gain unauthorized access.
Which versions of linlinjava litemall are affected by CVE-2025-10291?
CVE-2025-10291 affects all versions of linlinjava litemall up to and including 1.8.0.