| शीर्षक | SeriaWei ZKEACMS ZKEACMS.v4.3 ssrf |
|---|
| विवरण | In ZKEACMS Enterprise v.4.3, the default ZKEACMS.SEOSuggestions component contains CheckPage and Suggestions methods. While these methods are limited to checking the current page on the front end, this restriction is not enforced in back-end requests. Furthermore, there is no validation or filtering of the URL's host or scheme, which allows an authenticated administrator to force the server to issue arbitrary HTTP/HTTPS requests to internal or external network resources. |
|---|
| स्रोत | ⚠️ https://github.com/wooyun123/wooyun/issues/1 |
|---|
| उपयोगकर्ता | jiazhou (UID 89028) |
|---|
| सबमिशन | 04/09/2025 06:29 PM (1 वर्ष पहले) |
|---|
| संयम | 20/09/2025 10:47 AM (16 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 325120 [SeriaWei ZKEACMS तक 4.3 SEOSuggestions ZKEACMS.SEOSuggestions.dll CheckPage/Suggestions अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|