PT-2022-25359 · Z Blogphp · Z-Blogphp

Zer0Yu · Published 2022-09-20 · Updated 2022-09-22 · CVE-2022-40357

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Z-BlogPHP versions prior to 1.7.3

Description A security issue was discovered that allows remote attackers to force the application to make arbitrary requests via injection of arbitrary URLs into the source parameter, due to a Server-Side Request Forgery (SSRF) vulnerability in the zb users/plugin/UEditor/php/action crawler.php file.

Recommendations For versions prior to 1.7.3, update to version 1.7.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable file action crawler.php to minimize the risk of exploitation. Avoid using the source parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2022-40357

Affected Products

Z-Blogphp

References · 3

• 🔥 https://github.com/zblogcn/zblogphp/issues/336 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-40357 · Security Note
• https://osv.dev/vulnerability/CVE-2022-40357 · Vendor Advisory