CVE-2025-4118
📋 TL;DR
This vulnerability in Weitong Mall 1.0.0 allows remote attackers to bypass access controls by manipulating the 'isDelete' parameter in the /historyList endpoint. Attackers can potentially delete or modify product history data without proper authorization. All users running Weitong Mall 1.0.0 are affected.
💻 Affected Systems
- Weitong Mall
📦 What is this software?
Mall by Weitong
⚠️ Risk & Real-World Impact
Worst Case
Attackers could delete or tamper with critical product history data, causing data loss, business disruption, or inventory management issues.
Likely Case
Unauthorized deletion or modification of product history records, potentially affecting audit trails and business operations.
If Mitigated
Limited impact with proper access controls, logging, and monitoring in place to detect unauthorized access attempts.
🎯 Exploit Status
Exploit details are publicly disclosed. Attack requires some level of access but not necessarily full authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None found
Restart Required: No
Instructions:
No official patch available. Consider upgrading if newer versions exist, or implement workarounds.
🔧 Temporary Workarounds
Input Validation Filter
allAdd server-side validation to reject unexpected 'isDelete' parameter values
Modify /historyList endpoint code to validate 'isDelete' parameter
Access Control Enhancement
allImplement proper authorization checks before processing product history operations
Add role-based access control checks to Product History Handler
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block suspicious requests to /historyList endpoint
- Restrict network access to Weitong Mall administration interfaces using network segmentation
🔍 How to Verify
Check if Vulnerable:
Test if unauthorized requests to /historyList with isDelete=1 can modify product historyCheck Version:
Check Weitong Mall version in admin panel or configuration filesVerify Fix Applied:
Verify that unauthorized requests to /historyList with isDelete=1 are properly rejected📡 Detection & Monitoring
Log Indicators:
- Multiple failed authorization attempts on /historyList
- Unexpected product history deletions or modifications
Network Indicators:
- HTTP requests to /historyList with isDelete=1 from unauthorized sources
SIEM Query:
sourceIP:* AND uri:"/historyList" AND parameters:"isDelete=1" AND NOT userRole:"admin"