PT-2025-9182 · Unknown · Zorlan Skycaiji

Sheratan + 1 · Published 2025-03-01 · Updated 2025-06-12 · CVE-2025-1799

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Zorlan SkyCaiji version 2.9

Description A critical vulnerability was found in Zorlan SkyCaiji, affecting the previewAction function of the file vendor/skycaiji/app/admin/controller/Tool.php. The manipulation of the data argument leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Recommendations For Zorlan SkyCaiji version 2.9, as a temporary workaround, consider disabling the previewAction function until a patch is available. Restrict access to the vendor/skycaiji/app/admin/controller/Tool.php file to minimize the risk of exploitation. Avoid using the data argument in the affected function until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2025-1799

Affected Products

Zorlan Skycaiji

References · 13

• 🔥 https://github.com/sheratan4/cve/issues/6 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-1799 · Security Note
• https://osv.dev/vulnerability/CVE-2025-1799 · Vendor Advisory
• https://vuldb.com/?ctiid.298029 · Note
• https://twitter.com/VulmonFeeds/status/1895910438417625536 · Twitter Post
• https://vuldb.com/?id.298029 · Note
• https://t.me/cvenotify/113243 · Telegram Post
• https://twitter.com/CVEnew/status/1895981976743801167 · Twitter Post
• https://twitter.com/dailycve/status/1933298951123325218 · Twitter Post
• https://t.me/cvenotify/112995 · Telegram Post
• https://vuldb.com/?submit.502650 · Note
• https://t.me/cvedetector/19242 · Telegram Post
• https://t.me/cvenotify/125546 · Telegram Post