PT-2025-23201 · Unknown · Chshcms Mccms

Huanyue · Published 2025-05-29 · Updated 2025-05-29 · CVE-2025-5327

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions chshcms mccms version 2.7

Description A critical issue affects the function index of the file sys/apps/controllers/api/Gf.php. The manipulation of the argument pic leads to server-side request forgery. It is possible to initiate the attack remotely. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited.

Recommendations For version 2.7, as a temporary workaround, consider disabling the index function in the Gf.php file until a patch is available. Restrict access to the sys/apps/controllers/api/Gf.php file to minimize the risk of exploitation. Avoid using the argument pic in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2025-5327

Affected Products

Chshcms Mccms

References · 8

• 🔥 https://github.com/caigo8/CVE-md/blob/main/Mccms_V2.7/%E5%89%8D%E5%8F%B0SSRF.md · Exploit
• https://osv.dev/vulnerability/CVE-2025-5327 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-5327 · Security Note
• https://twitter.com/CVEnew/status/1928190299261567237 · Twitter Post
• https://t.me/cvetracker/24934 · Telegram Post
• https://vuldb.com/?submit.582295 · Note
• https://vuldb.com/?ctiid.310497 · Note
• https://vuldb.com/?id.310497 · Note