PT-2025-2053 · Unknown · Donglight Bookstore

Lvzc1 + 1 · Published 2025-01-08 · Updated 2025-08-22 · CVE-2024-13195

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions donglight bookstore versions 1.0.0

Description A critical issue affects the getHtml function of the file src/main/java/org/zdd/bookstore/rawl/HttpUtil.java. The manipulation of the url argument leads to server-side request forgery, allowing remote attack initiation. The exploit has been publicly disclosed and may be used.

Recommendations For version 1.0.0, consider disabling the getHtml function until a patch is available to prevent server-side request forgery. Restrict access to the HttpUtil.java file to minimize the risk of exploitation. Avoid using the url argument in the affected function until the issue is resolved.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2024-13195

Affected Products

Donglight Bookstore

References · 11

• 🔥 https://github.com/donglight/bookstore/issues/11#issue-2760929273 · Exploit
• 🔥 https://github.com/donglight/bookstore/issues/11 · Exploit
• https://osv.dev/vulnerability/CVE-2024-13195 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-13195 · Security Note
• https://vuldb.com/?ctiid.290787 · Note
• https://vuldb.com/?id.290787 · Note
• https://t.me/cvedetector/14751 · Telegram Post
• https://t.me/cvenotify/106850 · Telegram Post
• https://twitter.com/CVEnew/status/1877140831213105382 · Twitter Post
• https://t.me/cveNotify/133246 · Telegram Post
• https://vuldb.com/?submit.469689 · Note