CVE-2025-10275
📋 TL;DR
This vulnerability in YunaiV yudao-cloud allows attackers to bypass authorization controls by manipulating parameters in the /crm/business/transfer endpoint. Attackers can potentially transfer business ownership or perform unauthorized actions remotely. Organizations using yudao-cloud up to version 2025.09 are affected.
💻 Affected Systems
- YunaiV yudao-cloud
📦 What is this software?
Yudao Cloud by Iocoder
⚠️ Risk & Real-World Impact
Worst Case
Complete account takeover, unauthorized business data access/modification, or privilege escalation leading to full system compromise.
Likely Case
Unauthorized business ownership transfers, data leakage, or manipulation of CRM records by authenticated users.
If Mitigated
Limited impact with proper authentication and authorization controls, potentially only affecting specific business functions.
🎯 Exploit Status
Exploit details are publicly available; requires some technical knowledge to implement.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Monitor vendor channels for updates.
🔧 Temporary Workarounds
Disable vulnerable endpoint
allTemporarily disable or restrict access to /crm/business/transfer endpoint
Configure web server/application firewall to block /crm/business/transfer
Implement input validation
allAdd strict validation for ids and newOwnerUserId parameters
Implement server-side validation for parameter types and ranges
🧯 If You Can't Patch
- Implement network segmentation to isolate yudao-cloud instances
- Deploy WAF with custom rules to detect parameter manipulation attempts
🔍 How to Verify
Check if Vulnerable:
Test if unauthorized parameter manipulation in /crm/business/transfer endpoint succeedsCheck Version:
Check application version in yudao-cloud configuration or admin panelVerify Fix Applied:
Verify parameter manipulation attempts are properly rejected with authorization errors📡 Detection & Monitoring
Log Indicators:
- Unusual /crm/business/transfer requests
- Failed authorization attempts on transfer endpoint
- Parameter manipulation patterns in access logs
Network Indicators:
- HTTP POST requests to /crm/business/transfer with manipulated parameters
- Unusual business transfer activity patterns
SIEM Query:
source="web_logs" AND uri="/crm/business/transfer" AND (param_manipulation OR auth_failure)