PT-2025-22855 · Unknown · Seeyon Zhiyuan Oa Web Application System

Caichaoxiong · Published 2025-05-25 · Updated 2025-05-25 · CVE-2025-5140

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Seeyon Zhiyuan OA Web Application System versions up to 8.1 SP2

Description A critical vulnerability has been found in the Seeyon Zhiyuan OA Web Application System. This issue affects the this.oursNetService.getData function of the ThirdMenuController.class file. The manipulation of the url argument leads to server-side request forgery, allowing for remote attacks. The exploit has been publicly disclosed.

Recommendations For Seeyon Zhiyuan OA Web Application System versions up to 8.1 SP2, as a temporary workaround, consider disabling the this.oursNetService.getData function until a patch is available. Restrict access to the ThirdMenuController.class file to minimize the risk of exploitation. Avoid using the url argument in the affected function until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2025-5140

Affected Products

Seeyon Zhiyuan Oa Web Application System

References · 8

• 🔥 https://wx.mail.qq.com/s?k=i0-p-2N4MHcFOeM00E · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-5140 · Security Note
• https://t.me/cvenotify/123552 · Telegram Post
• https://vuldb.com/?ctiid.310221 · Note
• https://t.me/cvetracker/24593 · Telegram Post
• https://twitter.com/CVEnew/status/1926606804575732149 · Twitter Post
• https://vuldb.com/?id.310221 · Note
• https://vuldb.com/?submit.574440 · Note