CVE-2025-4118— Weitong Mall Product History historyList access control
Quick assessment
Affected
Weitong Mall
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Weitong Mall（微同商城）是fuyang_lipengjun个人开发者的一个商场系统。 Weitong Mall 1.0.0版本存在安全漏洞，该漏洞源于对参数isDelete的错误操作导致访问控制不当。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-4118
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Weitong Mall Product History historyList access control
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability classified as critical has been found in Weitong Mall 1.0.0. This affects an unknown part of the file /historyList of the component Product History Handler. The manipulation of the argument isDelete with the input 1 leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
访问控制不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
Weitong Mall 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Weitong Mall（微同商城）是fuyang_lipengjun个人开发者的一个商场系统。 Weitong Mall 1.0.0版本存在安全漏洞，该漏洞源于对参数isDelete的错误操作导致访问控制不当。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2025-4118
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-4118
请登录查看更多情报信息。
Vendor Advisories for CVE-2025-4118 (2)
-
CVE-2025-4118 Weitong Mall Product History historyList access control vdb-entry technical-description
-
Submit #560777: fuyang_lipengjun platform 1.0.0 broken function level authorization third-party-advisory
Security Blog Posts for CVE-2025-4118 (1)
Same Patch Batch · Weitong · 2025-04-30 · 3 CVEs total
| CVE-2025-4136 | 5.4 MEDIUM | Weitong Mall Sale Endpoint improper authorization |
| CVE-2025-4119 | 5.3 MEDIUM | Weitong Mall Product Statistics queryTotal access control |
IV. Related Vulnerabilities
Same product: Mall
-
CVE-2026-79406
macrozheng mall quantity OmsCartItemServiceImpl.updateQuanti -
CVE-2026-19361
macrozheng mall mall-portal getAuthCode password recovery -
CVE-2026-15186
macrozheng mall Portal Endpoint create resource injection -
CVE-2026-10070
macrozheng mall Super Admin Password update improper authori -
CVE-2026-25858
macrozheng mall <= 1.0.3 Unauthenticated Password Reset via
Same weakness: CWE-284
-
CVE-2026-81573
Improper Access Control in Local-Only Configuration Commands -
CVE-2026-77034
Joomla Extension - joomlaeventmanager.net - Unauthenticated -
CVE-2026-61790
Weblate: Team-enforced 2FA is bypassed for global permission -
CVE-2026-79940
iDRAC9 7.00.00.182/7.20.30.50前版本访问控制漏洞 -
CVE-2026-54256
Winter: Authenticated IDOR in backend FileUpload widget allo
V. Comments for CVE-2025-4118
No comments yet