EUVD-2025-201314Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Low-privilege remote attacker can manipulate dynamic variables to cause limited data exposure/modification.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
7DescriptionCVE.org
A flaw has been found in youlaitech youlai-mall 1.0.0/2.0.0. Affected is the function getById/updateAddress/deleteAddress of the file /mall-ums/app-api/v1/addresses/. Executing manipulation can lead to improper control of dynamically-identified variables. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Improper control of dynamically-identified variables in youlai-mall 1.0.0/2.0.0 allows authenticated low-privilege users to read or modify other users’ address data via the /mall-ums/app-api/v1/addresses/ endpoint. Public exploit code is available, though no evidence of active exploitation exists at this time. The vendor was notified but did not respond.
Technical ContextAI
The vulnerability (CWE-913: Improper Control of Dynamically-Identified Variables) resides in the address management API of youlai-mall, specifically the getById, updateAddress, and deleteAddress functions under /mall-ums/app-api/v1/addresses/. The product, identified by CPE cpe:2.3:a:youlai:youlai-mall:1.0.0 and 2.0.0, likely fails to validate that a user-provided identifier corresponds to the authenticated user’s own resources, enabling manipulation of parameters such as address IDs to access or alter data belonging to other users.
RemediationAI
No vendor-released patch is available; the vendor was contacted but did not respond. As a compensating control, consider disabling the /mall-ums/app-api/v1/addresses/ endpoint entirely if address management is not critical, noting that this removes all address functionality. Alternatively, apply a web application firewall rule to block requests that manipulate user-controlled variable identifiers in the affected API endpoints, though this may interfere with legitimate use if not carefully tuned.
More in Youlai Mall
View allIn youlai-mall 1.0.0 and 2.0.0, authenticated users with low privileges can manipulate the orderId parameter in the /app
Improper authorization in Youlai Mall 1.0.0 and 2.0.0 allows authenticated remote attackers to manipulate the orderSn pa
A security vulnerability in A vulnerability (CVSS 6.3). Risk factors: public PoC available.
Improper access controls in Youlai Mall 1.0.0 and 2.0.0 allow authenticated remote attackers to disclose member informat
A security vulnerability in A vulnerability (CVSS 6.3). Risk factors: public PoC available.
SQL injection in Youlai Mall 2.0.0's product pagination endpoint allows authenticated remote attackers to manipulate the
Improper access controls in the Order Payment Handler (orderService.payOrder method) of Youlai Mall 1.0.0 and 2.0.0 allo
Improper authorization in the MemberController.deductBalance() function of Youlai Mall 1.0.0 and 2.0.0 allows authentica
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today