CVE-2025-25770
📋 TL;DR
Wangmarket v4.10 to v5.0 contains a Cross-Site Request Forgery (CSRF) vulnerability in the AgencyUserController component. This allows attackers to trick authenticated users into performing unintended actions on their behalf. Users of affected Wangmarket versions are vulnerable.
💻 Affected Systems
- Wangmarket
📦 What is this software?
Wangmarket by Wang.market
⚠️ Risk & Real-World Impact
Worst Case
Attackers could create, modify, or delete agency user accounts, potentially gaining administrative access or disrupting business operations.
Likely Case
Unauthorized changes to user permissions or account details, leading to privilege escalation or data manipulation.
If Mitigated
With proper CSRF protections, the vulnerability would be blocked, preventing unauthorized actions.
🎯 Exploit Status
CSRF attacks typically require user interaction (e.g., clicking a malicious link) and authenticated sessions.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: No vendor advisory found in provided references
Restart Required: No
Instructions:
1. Monitor Wangmarket vendor for security updates. 2. Apply patch when available. 3. Test in non-production environment first.
🔧 Temporary Workarounds
Implement CSRF Tokens
allAdd anti-CSRF tokens to forms and validate them server-side in AgencyUserController.java.
Modify Java code to include CSRF token generation and validation
Use SameSite Cookies
allSet SameSite=Strict or Lax on session cookies to prevent CSRF via cross-site requests.
Set-Cookie: session=value; SameSite=Strict; Secure; HttpOnly
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to detect and block CSRF patterns.
- Educate users about phishing risks and require re-authentication for sensitive actions.
🔍 How to Verify
Check if Vulnerable:
Review AgencyUserController.java for missing CSRF protection in v4.10-v5.0 deployments.Check Version:
Check Wangmarket version in admin panel or application configuration files.Verify Fix Applied:
Test that CSRF tokens are required and validated for all AgencyUserController actions.📡 Detection & Monitoring
Log Indicators:
- Unusual user account modifications from unexpected IPs or without CSRF tokens
Network Indicators:
- HTTP POST requests to /agency/AgencyUserController without referrer validation
SIEM Query:
source="web_logs" AND uri="/agency/AgencyUserController" AND csrf_token="null"