CVE-2025-12304 Overview
CVE-2025-12304 is an improper authorization vulnerability [CWE-266] in the dulaiduwang003 TIME-SEA-PLUS application. The flaw resides in the alipayIsSucceed function of PayController.java, part of the Order Status Handler component. Affected code exists up to commit fb299162f18498dd9cf17da906886d80a077d53b. A remote attacker with low privileges can manipulate order status handling to bypass authorization checks. The exploit details have been publicly disclosed, increasing the likelihood of opportunistic abuse against exposed deployments.
Critical Impact
Remote authenticated attackers can manipulate the Alipay payment success handler to modify order state, potentially marking unpaid orders as paid without authorization.
Affected Products
- dulaiduwang003 TIME-SEA-PLUS up to commit fb299162f18498dd9cf17da906886d80a077d53b
- Component: Order Status Handler (PayController.java)
- Function: alipayIsSucceed
Discovery Timeline
- 2025-10-27 - CVE-2025-12304 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-12304
Vulnerability Analysis
The vulnerability affects the alipayIsSucceed function within PayController.java, which handles Alipay payment success callbacks in TIME-SEA-PLUS. The handler performs insufficient authorization validation on the order state transition request. An attacker with a low-privileged account can issue crafted requests over the network to trigger the order-success path without a legitimate payment. The issue is classified as improper authorization under [CWE-266], meaning the application acts on user-supplied input without confirming the requester is entitled to change the target order's status.
Root Cause
The controller endpoint accepts order status transitions from remote callers without verifying that the caller owns the order or that a genuine payment notification from Alipay backs the request. Trust is placed on client-supplied identifiers rather than a server-side reconciliation against Alipay's signed notification data. This design gap allows the state machine to advance an order to "paid" based on a request that does not originate from an authorized payment event.
Attack Vector
Exploitation requires network access and a low-privileged authenticated session (PR:L). No user interaction is required. An attacker sends a request to the alipayIsSucceed handler referencing a target order, bypassing the intended payment verification workflow. Because the exploit has been disclosed publicly through the referenced GitHub issue and VulDB entries, attackers can reproduce the technique with minimal reverse-engineering effort. See the GitHub Issue Report for the disclosed technical detail.
Detection Methods for CVE-2025-12304
Indicators of Compromise
- Unexpected HTTP requests to the alipayIsSucceed endpoint that do not correlate with legitimate Alipay callback traffic.
- Orders transitioning to a paid state without matching entries in Alipay reconciliation logs.
- Repeated requests to the payment success handler from a single low-privileged session referencing multiple order identifiers.
Detection Strategies
- Correlate application access logs with Alipay's asynchronous notification records to detect state changes lacking upstream payment events.
- Baseline the ratio of successful payment callbacks per authenticated user and alert on statistical outliers.
- Instrument the PayController class with audit logging that records the caller identity, source IP, and target order identifier on each invocation.
Monitoring Recommendations
- Stream web server and application logs into a centralized analytics platform for query-driven hunting across payment-handling endpoints.
- Alert on any invocation of alipayIsSucceed where the request origin is not an Alipay notification IP range.
- Track order-status change velocity per user account and flag accounts exceeding normal transaction volume.
How to Mitigate CVE-2025-12304
Immediate Actions Required
- Restrict network access to the payment callback endpoint to trusted Alipay notification source ranges only.
- Enforce server-side verification of Alipay's asynchronous notification signature before advancing any order to a paid state.
- Audit historical order records for unpaid-to-paid transitions that lack corresponding Alipay settlement entries.
Patch Information
No official vendor patch has been referenced in the published advisories. Monitor the upstream repository and VulDB entry 329976 for remediation updates. Until a fix is issued, apply compensating controls at the application and network layers.
Workarounds
- Add an authorization check in alipayIsSucceed that validates the authenticated principal owns the referenced order.
- Verify Alipay signature and transaction identifiers server-side against Alipay's API before mutating order state.
- Place the payment callback endpoint behind a reverse proxy that enforces an IP allowlist for Alipay notification sources.
- Rate-limit requests to payment-handling endpoints per authenticated session to slow automated abuse.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.