CVE-2025-10992 (CNNVD-202509-4217)
中文标题:
roncoo-pay 授权问题漏洞
英文标题:
roncoo roncoo-pay lookupList improper authorization
漏洞描述
中文描述:
roncoo-pay（龙果支付系统）是领课网络（RonCoo）开源的一个互联网支付系统。 roncoo-pay存在授权问题漏洞，该漏洞源于文件/user/info/lookupList中未知函数存在授权不当，可能导致远程攻击。
英文描述:
A vulnerability was determined in roncoo roncoo-pay up to 9428382af21cd5568319eae7429b7e1d0332ff40. Affected is an unknown function of the file /user/info/lookupList. Executing manipulation can lead to improper authorization. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The vendor was contacted early about this disclosure but did not respond in any way.
CWE类型:
标签:
受影响产品
| 厂商 | 产品 | 版本 | 版本范围 | 平台 | CPE |
|---|---|---|---|---|---|
| roncoo | roncoo-pay | 9428382af21cd5568319eae7429b7e1d0332ff40 | - | - |
cpe:2.3:a:roncoo:roncoo-pay:9428382af21cd5568319eae7429b7e1d0332ff40:*:*:*:*:*:*:*
|
解决方案
中文解决方案:
英文解决方案:
临时解决方案:
CVSS评分详情
4.0 (cna)
MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
3.1 (cna)
MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R
3.0 (cna)
MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R
2.0 (cna)
MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:UR
时间信息
利用信息
数据源详情
| 数据源 | 记录ID | 版本 | 提取时间 |
|---|---|---|---|
| CVE | cve_CVE-2025-10992 |
2025-11-11 15:23:02 | 2025-11-11 07:40:04 |
| NVD | nvd_CVE-2025-10992 |
2025-11-11 15:01:04 | 2025-11-11 07:47:55 |
| CNNVD | cnnvd_CNNVD-202509-4217 |
2025-11-11 15:12:58 | 2025-11-11 08:00:14 |
版本与语言
安全公告
变更历史
查看详细变更
- vulnerability_type: 未提取 -> 授权问题
- cnnvd_id: 未提取 -> CNNVD-202509-4217
- data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
查看详细变更
- data_sources: ['cve'] -> ['cve', 'nvd']