PT-2025-49030 · Dayrui · Xunruicms

Nobb · Published 2025-12-04 · Updated 2025-12-05 · CVE-2025-14008

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions dayrui XunRuiCMS versions up to 4.7.1

Description A server-side request forgery condition exists in dayrui XunRuiCMS. The issue is located in the file admin79f2ec220c7e.php?c=api&m=test site domain within the Project Domain Change Test component. Manipulation of the v parameter can trigger the flaw, allowing for remote exploitation. The exploit has been published. The vendor was contacted but did not respond.

Recommendations Versions prior to 4.7.1 should be used.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2025-14008

Affected Products

Xunruicms

References · 10

• 🔥 https://github.com/24-2021/vul/blob/main/xunruicms-test_site_domain-SSRF/xunruicms-test_site_domain-SSRF.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-14008 · Security Note
• https://osv.dev/vulnerability/CVE-2025-14008 · Vendor Advisory
• https://twitter.com/dailycve/status/1997080182113386806 · Twitter Post
• https://vuldb.com/?id.334250 · Note
• https://twitter.com/VulmonFeeds/status/1996646526362267662 · Twitter Post
• https://vuldb.com/?submit.692915 · Note
• https://twitter.com/CVEnew/status/1996600317975122242 · Twitter Post
• https://vuldb.com/?ctiid.334250 · Note
• https://t.me/CVEtracker/38816 · Telegram Post