CVE-2025-10822: Fuyang Platform Authorization Bypass Flaw

CVE-2025-10822 Overview

CVE-2025-10822 is an improper authorization vulnerability in fuyang_lipengjun platform version 1.0. The flaw resides in the SysSmsLogController function accessible through the /sys/smslog/queryAll endpoint. Remote attackers with low-level authentication can query SMS log records without proper access control checks. The exploit details have been publicly disclosed, increasing the risk of opportunistic attacks against exposed instances. The vulnerability is classified under [CWE-266: Incorrect Privilege Assignment].

Critical Impact
Authenticated remote attackers can bypass authorization controls to access SMS log data through the /sys/smslog/queryAll endpoint, exposing potentially sensitive communication records.

Affected Products

fuyang_lipengjun platform 1.0.0
Component: fuyang_lipengjun:platform
Vulnerable endpoint: /sys/smslog/queryAll

Discovery Timeline

2025-09-23 - CVE-2025-10822 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10822

Vulnerability Analysis

The vulnerability affects the SysSmsLogController handler in the fuyang_lipengjun platform. The controller exposes the /sys/smslog/queryAll endpoint, which returns SMS log entries from the underlying data store. The endpoint fails to enforce proper authorization checks matching the caller's assigned role. As a result, an authenticated user with low privileges can invoke an administrative query intended only for higher-privileged accounts. The impact is limited to confidentiality of SMS log records; integrity and availability of the platform remain unaffected per the vendor-supplied vector.

Root Cause

The root cause is missing or incorrect privilege enforcement in the request-handling pipeline for /sys/smslog/queryAll. The controller method executes the query without validating whether the authenticated principal holds the required administrative role. This aligns with [CWE-266: Incorrect Privilege Assignment], where a user is granted access to a resource beyond their intended authorization scope.

Attack Vector

An attacker requires network access to the application and a valid low-privilege account. The attacker sends an HTTP request to /sys/smslog/queryAll, which returns SMS log records that should be restricted to administrative users. No user interaction is required, and the attack complexity is low. Technical details describing the flaw have been published through VulDB Entry #325179 and the CNBlogs Analysis Post.

No verified proof-of-concept code is included in this advisory. Refer to the published external references for reproduction details.

Detection Methods for CVE-2025-10822

Indicators of Compromise

HTTP requests to /sys/smslog/queryAll from user accounts that do not hold administrative roles.
Anomalous volumes of successful 200 OK responses from the SysSmsLogController endpoint.
Access patterns to /sys/smslog/* endpoints originating from non-administrative session tokens.

Detection Strategies

Instrument the web application or reverse proxy to log the authenticated user identity for every call to /sys/smslog/queryAll.
Correlate the caller's role assignment against the endpoint sensitivity to flag unauthorized access attempts.
Baseline normal administrative activity on SMS log endpoints and alert on deviations from that baseline.

Monitoring Recommendations

Enable request-level auditing on all /sys/* administrative endpoints in the fuyang_lipengjun platform.
Forward web server access logs to a centralized analytics platform for role-versus-endpoint correlation.
Monitor outbound data volumes from the application server for signs of bulk log extraction.

How to Mitigate CVE-2025-10822

Immediate Actions Required

Restrict network access to the /sys/smslog/queryAll endpoint at the reverse proxy or web application firewall to trusted administrative source ranges.
Audit existing user accounts and revoke unnecessary access to the fuyang_lipengjun platform.
Review application access logs for prior unauthorized calls to SysSmsLogController handlers.

Patch Information

No vendor advisory or official patch has been published for CVE-2025-10822 at the time of this writing. Consult the VulDB CTIID #325179 entry and the upstream project repository for status updates on remediation.

Workarounds

Add an authorization filter or interceptor that verifies the caller holds an administrative role before permitting access to /sys/smslog/* routes.
Deploy a web application firewall rule that blocks non-administrative sessions from requesting the queryAll endpoint.
Where feasible, disable the SMS log query feature until an authoritative fix is released.

bash

# Example nginx rule restricting the vulnerable endpoint to trusted IPs
location = /sys/smslog/queryAll {
    allow 10.0.0.0/8;      # internal admin subnet
    deny  all;
    proxy_pass http://platform_backend;
}