CVE-2025-13443 Overview
CVE-2025-13443 is an improper access control vulnerability in macrozheng mall, an open-source e-commerce platform. The flaw affects versions up to 1.0.3 and resides in the delete function of the /member/readHistory/delete endpoint. Attackers can manipulate the ids parameter to bypass access controls and delete read-history records belonging to other users. The vulnerability requires low privileges and is exploitable remotely over the network. Public disclosure of exploitation details has occurred, though no weaponized exploit has been catalogued in Exploit-DB or the CISA Known Exploited Vulnerabilities catalog.
Critical Impact
Authenticated remote attackers can manipulate the ids parameter on the read-history delete endpoint to remove records without proper authorization checks, resulting in limited integrity and availability impact on member data.
Affected Products
- macrozheng mall versions up to and including 1.0.3
- Component: /member/readHistory/delete endpoint
- CPE: cpe:2.3:a:macrozheng:mall:*:*:*:*:*:*:*:*
Discovery Timeline
- 2025-11-20 - CVE-2025-13443 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-13443
Vulnerability Analysis
The vulnerability is classified under CWE-266: Incorrect Privilege Assignment. It stems from missing ownership verification in the delete function of the member read-history controller. The endpoint /member/readHistory/delete accepts an ids parameter representing record identifiers to remove. The application processes these identifiers without confirming that the authenticated caller owns the referenced records. An authenticated user can therefore submit arbitrary identifier values and delete history records associated with other member accounts.
Root Cause
The root cause is the absence of a server-side authorization check tying record ownership to the requesting principal. The delete handler trusts the identifiers supplied by the client and performs the deletion using the identifier list directly. No filter constrains the operation to records where the owning member matches the authenticated session, resulting in a broken access control pattern common to insecure direct object reference issues.
Attack Vector
Exploitation requires network access and a valid member account. The attacker authenticates to the application, then issues a request to /member/readHistory/delete supplying identifier values that belong to other members. Because the server does not verify ownership, the referenced records are deleted. The impact is bounded to the read-history data model, which limits integrity and availability effects rather than exposing broader account takeover paths.
No verified proof-of-concept code has been published in the referenced sources. See the GitHub issue discussion and VulDB entry #333016 for reporter notes.
Detection Methods for CVE-2025-13443
Indicators of Compromise
- Unexpected DELETE or POST requests to /member/readHistory/delete containing large or sequential ids values.
- Application logs showing a single authenticated session deleting read-history records across multiple member_id values.
- Sudden drops in ms_member_read_history (or equivalent) row counts without corresponding user activity.
Detection Strategies
- Instrument the /member/readHistory/delete endpoint to log the authenticated member_id alongside each ids value processed and alert on mismatches.
- Deploy WAF rules that flag requests with high-cardinality or enumerated ids parameters on member-scoped endpoints.
- Correlate access logs with database audit trails to identify deletions that cross tenant or user boundaries.
Monitoring Recommendations
- Enable verbose audit logging on all /member/* endpoints exposing object identifiers.
- Baseline normal delete volumes per member account and alert on statistical anomalies.
- Forward application and database logs to a centralized analytics platform to support cross-source correlation and retention.
How to Mitigate CVE-2025-13443
Immediate Actions Required
- Restrict access to /member/readHistory/delete at the reverse proxy or API gateway until an authorization fix is deployed.
- Apply a server-side ownership check that filters the delete query by the authenticated member_id.
- Rotate session tokens and audit read-history tables for unauthorized deletions.
Patch Information
As of the last NVD modification date (2026-06-17), no vendor advisory or fixed release has been published in the referenced sources. Monitor the macrozheng mall GitHub repository and the VulDB entry #333016 for updates. Organizations running versions up to 1.0.3 should treat the endpoint as vulnerable and implement compensating controls.
Workarounds
- Add a WHERE clause in the delete SQL statement that binds member_id to the authenticated principal derived from the session, not from client input.
- Introduce a service-layer guard that resolves each submitted id to its owner and rejects requests where ownership does not match the caller.
- Rate-limit the endpoint per authenticated account to reduce enumeration impact while a patch is prepared.
# Example nginx configuration to temporarily block the vulnerable endpoint
location = /member/readHistory/delete {
deny all;
return 403;
}
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
