CVE-2025-13443
📋 TL;DR
This vulnerability in macrozheng mall allows attackers to bypass access controls and delete user read history records without proper authorization. Remote exploitation is possible, affecting all users of versions up to 1.0.3. The vulnerability stems from improper access controls in the delete function.
💻 Affected Systems
- macrozheng mall
📦 What is this software?
Mall by Macrozheng
⚠️ Risk & Real-World Impact
Worst Case
Attackers could delete all user read history data, potentially causing data loss and disrupting user experience.
Likely Case
Unauthorized deletion of specific user read history records, leading to data integrity issues.
If Mitigated
Minimal impact with proper authentication and authorization checks in place.
🎯 Exploit Status
Exploit is publicly available and manipulation of ids parameter leads to improper access controls.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: unknown
Vendor Advisory: none
Restart Required: No
Instructions:
Upgrade to version above 1.0.3 if available, otherwise implement workarounds.
🔧 Temporary Workarounds
Implement proper authorization checks
allAdd server-side validation to ensure users can only delete their own read history records.
Restrict access to delete endpoint
allImplement IP whitelisting or additional authentication for the /member/readHistory/delete endpoint.
🧯 If You Can't Patch
- Implement web application firewall rules to block suspicious delete requests
- Monitor and alert on unauthorized delete operations to the affected endpoint
🔍 How to Verify
Check if Vulnerable:
Check if running macrozheng mall version 1.0.3 or earlier and test if unauthorized users can delete read history via /member/readHistory/delete endpoint.Check Version:
Check application configuration files or database for version information.Verify Fix Applied:
Verify that proper authorization checks are implemented and only authenticated users can delete their own records.📡 Detection & Monitoring
Log Indicators:
- Multiple DELETE requests to /member/readHistory/delete from unauthorized users
- Unusual deletion patterns in user history logs
Network Indicators:
- HTTP DELETE requests to /member/readHistory/delete with manipulated ids parameter
SIEM Query:
source="web_logs" AND uri="/member/readHistory/delete" AND method="DELETE" AND (user_id NOT IN authorized_users OR status=200)