Vulnerability · Published Oct 27, 2025 · Assigned by VulDB

CVE-2025-12304dulaiduwang003 TIME-SEA-PLUS Order Status PayController.java alipayIsSucceed improper authorization

Medium 4.3

In plain English

A medium-severity security flaw in TIME-SEA-PLUS from dulaiduwang003. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.3%top 81.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability has been found in dulaiduwang003 TIME-SEA-PLUS up to fb299162f18498dd9cf17da906886d80a077d53b. This affects the function alipayIsSucceed of the file PayController.java of the component Order Status Handler. The manipulation leads to improper authorization. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.

Affected products (as reported)

Vendor	Product	Versions
dulaiduwang003	TIME-SEA-PLUS	fb299162f18498dd9cf17da906886d80a077d53b

Weakness: CWE-285, CWE-266 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R

References

VDB-329976 | dulaiduwang003 TIME-SEA-PLUS Order Status PayController.java alipayIsSucceed improper authorization vdb-entry, technical-description
VDB-329976 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #676283 | TIME-SEA-PLUS <=2.4 Improper Control of Resource Identifiers third-party-advisory
https://github.com/Hwwg/cve/issues/3 exploit, issue-tracking