CVE-2025-4118

Executive Summary

CVE-2025-4118 is a critical improper access control vulnerability identified in Weitong Mall version 1.0.0. The flaw resides in the /historyList endpoint of the Product History Handler component. By manipulating the isDelete argument to 1, an unauthenticated remote attacker can bypass authorization checks, potentially deleting or modifying product history records. The exploit has been publicly disclosed, increasing the risk of active exploitation. No official patch is currently available, and the vendor (Weitong) has not released a security advisory. This vulnerability is not related to a WordPress plugin or component; it is a standalone e-commerce application.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Base Score calculated below)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Impact confined to the vulnerable component.
• Confidentiality (C): High (H) – Potential unauthorized access to history data.
• Integrity (I): High (H) – Potential unauthorized modification/deletion of records.
• Availability (A): None (N) – No direct impact on availability.
• Base Score: 9.1 (Critical)

Threat Level: Critical. The combination of remote exploitability, no authentication, and public exploit code makes this a high-priority target for threat actors.

Deep Dive & Mechanics

The vulnerability is a classic case of Improper Access Control (CWE-284) . The /historyList endpoint likely performs an action (e.g., soft-delete or hard-delete) on product history records based on the isDelete parameter. The application fails to verify whether the requesting user has the necessary permissions to perform this action. By simply sending a request with isDelete=1, an attacker can trigger the deletion or modification of history entries without any authentication.

Technical Flow:

1. The attacker sends an HTTP request to /historyList with the parameter isDelete=1.
2. The server-side code processes the request without checking for a valid session or authorization token.
3. The application executes a database query to update or delete records based on the isDelete flag.
4. The history records are altered or removed, potentially causing data loss or manipulation.

Root Cause: The absence of an access control check on the server-side handler for the isDelete parameter. The application likely relies on client-side controls or assumes that only authenticated users can reach this endpoint, which is a flawed security assumption.

Vulnerable vs. Patched Code

Since no official patch exists, the following is a conceptual comparison.

Vulnerable Code (PHP/Node.js example):

// Vulnerable: No authentication check
if ($_GET['isDelete'] == 1) {
    $db->query("DELETE FROM history WHERE id = " . $_GET['id']);
}

Patched Code (Conceptual):

// Patched: Authentication and authorization check
session_start();
if (!isset($_SESSION['user']) || $_SESSION['role'] != 'admin') {
    http_response_code(403);
    exit('Forbidden');
}
if ($_GET['isDelete'] == 1) {
    $id = intval($_GET['id']); // Input sanitization
    $stmt = $db->prepare("DELETE FROM history WHERE id = ?");
    $stmt->bind_param("i", $id);
    $stmt->execute();
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target running Weitong Mall 1.0.0.
• Network access to the /historyList endpoint.

Exploit Steps:

1. Identify the target URL (e.g., http://target.com/historyList).
2. Send a crafted HTTP request with the isDelete parameter set to 1 and optionally an id parameter to target a specific record.
3. Observe the response (e.g., 200 OK with success message) and verify the deletion/modification.

Example cURL Command:

curl -X GET "http://target.com/historyList?isDelete=1&id=123"

Expected Outcome: The history record with ID 123 is deleted or marked as deleted.

Blue Team (Detection & Mitigation)

Detection:

• Monitor HTTP requests to /historyList for unusual patterns, especially from unauthenticated sources.
• Look for requests containing isDelete=1 without a valid session cookie.
• Alert on multiple rapid requests to this endpoint.

Mitigation (Temporary):

• Implement a Web Application Firewall (WAF) rule to block requests to /historyList with isDelete=1 unless from authenticated admin IPs.
• Disable the endpoint entirely if not required.
• Apply input validation and access control checks on the server side.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP GET requests to /historyList with parameter isDelete=1.
  • Source IPs making repeated requests to this endpoint without authentication.
  • Unusual response sizes or error messages from /historyList.

• File IOCs:

  • Log entries showing DELETE FROM history queries without a preceding authentication event.
  • Modified or deleted entries in the history table of the database.

• Behavioral IOCs:

  • Sudden disappearance of product history records.
  • Unexplained changes to order or product history data.

Detection Engineering

YARA Rule

rule CVE_2025_4118_Weitong_Mall_Access_Control {
    meta:
        description = "Detects exploitation attempts of CVE-2025-4118 in Weitong Mall"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-4118"
    strings:
        $s1 = "/historyList" ascii wide nocase
        $s2 = "isDelete=1" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2025-4118 Weitong Mall Unauthenticated Access to /historyList
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects HTTP requests to /historyList with isDelete=1 parameter, indicating exploitation of CVE-2025-4118.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-query|contains: "/historyList"
        cs-uri-query|contains: "isDelete=1"
    condition: selection
falsepositives:
    - Legitimate admin actions (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-4118 Weitong Mall Unauthenticated Access to /historyList"; flow:to_server; content:"/historyList"; http_uri; content:"isDelete=1"; http_uri; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the /historyList endpoint if not essential for business operations.
2. Implement a WAF rule to block requests containing isDelete=1 from unauthenticated sources.
3. Review server logs for any signs of exploitation.

Long-Term Fix:

• Apply proper access controls: Ensure all sensitive endpoints require authentication and authorization.
• Input validation: Sanitize and validate all parameters, especially those that trigger database operations.
• Update to a patched version: Monitor the vendor (Weitong) for an official patch or security update.
• Conduct a security audit: Review the entire application for similar access control flaws.

Workaround:

• If the endpoint is needed, restrict access by IP address to only trusted admin networks.

Valters IT
Securing Digital Frontiers