CVE-2025-10819: Fuyang Lipengjun Platform Auth Bypass

CVE-2025-10819 Overview

CVE-2025-10819 is an improper authorization vulnerability [CWE-266] affecting fuyang_lipengjun platform version 1.0. The flaw resides in the UserCouponController component, specifically the /usercoupon/queryAll endpoint. An authenticated remote attacker can exploit the weak authorization check to access coupon data belonging to other users. The exploit has been publicly disclosed, increasing the likelihood of opportunistic abuse against exposed instances.

Critical Impact
Remote authenticated attackers can bypass authorization controls on the /usercoupon/queryAll endpoint to enumerate user coupon records, resulting in confidentiality loss.

Affected Products

fuyang_lipengjun platform 1.0.0
UserCouponController component
/usercoupon/queryAll API endpoint

Discovery Timeline

2025-09-22 - CVE-2025-10819 published to NVD
2026-10-11 - Last updated in NVD database

Technical Details for CVE-2025-10819

Vulnerability Analysis

The vulnerability affects the UserCouponController class in fuyang_lipengjun platform 1.0. The /usercoupon/queryAll endpoint fails to properly validate whether the requesting user is authorized to retrieve the records being queried. As a result, any authenticated low-privileged user can request coupon data outside of their scope. The flaw is categorized under CWE-266: Incorrect Privilege Assignment. Public disclosure of exploitation details lowers the barrier for abuse, though the attack requires valid credentials and only exposes limited confidential information.

Root Cause

The root cause is a missing or incorrectly implemented authorization check within the UserCouponController.queryAll handler. The controller returns coupon records without filtering by the authenticated user identity or verifying role-based access requirements. This design flaw allows horizontal privilege escalation across user accounts.

Attack Vector

Exploitation requires network access to the application and valid low-privileged credentials. An attacker sends a crafted HTTP request to /usercoupon/queryAll and receives coupon records belonging to other users. No user interaction is required. See the CNBlogs Security Analysis and VulDB entry #325176 for additional technical details.

Detection Methods for CVE-2025-10819

Indicators of Compromise

Unusual volume of HTTP requests to the /usercoupon/queryAll endpoint from a single authenticated session.
Application logs showing successful responses to queryAll requests that return records tied to multiple user identifiers.
Access patterns where a single account retrieves coupon data at a rate inconsistent with normal user behavior.

Detection Strategies

Audit web server and application logs for repeated calls to /usercoupon/queryAll and correlate the response size with expected per-user record counts.
Deploy web application firewall (WAF) rules that flag requests to the queryAll endpoint lacking a user-scoping parameter.
Review authentication logs for low-privileged accounts accessing administrative or bulk-query endpoints.

Monitoring Recommendations

Enable verbose logging on the UserCouponController to capture request parameters and authenticated principal for each invocation.
Baseline normal query volume per user and alert on statistical deviations.
Forward application logs to a centralized SIEM for correlation with authentication telemetry.

How to Mitigate CVE-2025-10819

Immediate Actions Required

Restrict network access to the /usercoupon/queryAll endpoint to trusted administrative networks until a vendor fix is available.
Disable or remove the queryAll endpoint if it is not required for business operations.
Review recent access logs for signs of unauthorized bulk queries and rotate any exposed coupon codes.

Patch Information

No vendor patch has been published for fuyang_lipengjun platform 1.0 at the time of writing. Monitor the VulDB advisory for updates and apply any upstream fix immediately upon release.

Workarounds

Implement a reverse proxy or WAF rule that blocks requests to /usercoupon/queryAll from non-administrative accounts.
Add a server-side authorization filter that validates the authenticated principal against the requested data scope before returning results.
Enforce strong authentication and session management to reduce the pool of accounts available for exploitation.

bash

# Example nginx configuration to restrict access to the vulnerable endpoint
location /usercoupon/queryAll {
    allow 10.0.0.0/8;      # internal admin network
    deny all;
    proxy_pass http://backend;
}