CVE-2025-10287 roncoo roncoo-pay orderQuery direct request
Attackers can bypass authorization to query order details directly via the orderQuery endpoint, exposing sensitive transaction data.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-10287?
CVE-2025-10287 is a low-severity missing authorization vulnerability in roncoo-pay, published on 12 Sep 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A vulnerability has been found in roncoo roncoo-pay up to 9428382af21cd5568319eae7429b7e1d0332ff40. The affected element is an unknown function of the file /auth/orderQuery. Such manipulation of the argument orderNo leads to direct request. The attack may be performed from remote. A high complexity level is associated with this attack. The exploitability is described as difficult. The exploit has been disclosed to the public and may be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The vendor was contacted early about this disclosure but did not respond in any way.
Weakness: CWE-425
Which versions are affected by CVE-2025-10287?
How do I fix CVE-2025-10287?
No fix has been published for CVE-2025-10287 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-10287 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-10287 exists.
Sources
Also known as GHSA-rm4g-r867-8r8c.