CVE-2025-14016
BaseFortify
Publication date: 2025-12-04
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| macrozheng | mall-swarm | to 1.0.3 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-285 | The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. |
| CWE-863 | The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. |
| CWE-266 | A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring and intercepting API requests to the endpoint POST /member/readHistory/delete. Look for requests where the 'ids' parameter is manipulated to include entries not belonging to the authenticated user. For detection, you can use tools like curl or intercepting proxies (e.g., Burp Suite) to capture and analyze requests. Example command to test unauthorized deletion attempt: curl -X POST 'https://yourmallswarminstance/member/readHistory/delete' -H 'Authorization: Bearer <token_of_user_A>' -d 'ids=<ids_of_user_B>' and observe if the response indicates successful deletion (e.g., code: 200, message: "ζδ½ζε"). Monitoring logs for such unauthorized access patterns or unexpected deletions can also help detect exploitation attempts. [2]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the vulnerable API endpoint and monitoring for suspicious activity involving the 'ids' parameter in delete requests. Since no official patch or vendor response is available, consider replacing the affected product or disabling the delete functionality temporarily. Implement additional authorization checks on the server side to verify ownership of the 'ids' before processing deletion requests. Also, review and tighten access control policies and monitor logs for unauthorized deletion attempts. [1, 2]
Can you explain this vulnerability to me?
This vulnerability exists in macrozheng mall-swarm up to version 1.0.3, specifically in the delete function of the /member/readHistory/delete file. It involves improper authorization due to manipulation of the argument 'ids', allowing an attacker to remotely execute the attack without proper permissions.
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized deletion of user read history data by an attacker remotely exploiting the improper authorization. This could result in loss or alteration of user data and potential disruption of service or user trust.