CVE-2025-0480
📋 TL;DR
This CVE-2025-0480 vulnerability in wuzhicms 4.1.0 allows attackers to perform server-side request forgery (SSRF) by manipulating sphinxhost/sphinxport parameters in the search admin configuration. Attackers can potentially access internal services or make unauthorized requests from the server. Only wuzhicms 4.1.0 installations with the search module enabled are affected.
💻 Affected Systems
- wuzhicms
📦 What is this software?
Wuzhicms by Wuzhicms
⚠️ Risk & Real-World Impact
Worst Case
Attackers could access internal services, sensitive data, or use the server as a proxy for attacks against other internal systems.
Likely Case
Information disclosure from internal services, limited internal network scanning, or denial of service against internal systems.
If Mitigated
Minimal impact if network segmentation restricts internal access and input validation is implemented.
🎯 Exploit Status
Exploit requires admin access to the search configuration interface. Public disclosure includes technical details.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Consider upgrading to a newer version if available or implementing workarounds.
🔧 Temporary Workarounds
Disable search module
allRemove or disable the vulnerable search module to prevent exploitation.
Disable via admin panel or remove coreframe/app/search directory
Input validation
allAdd validation for sphinxhost/sphinxport parameters to restrict allowed values.
Modify coreframe/app/search/admin/config.php to validate host/port inputs
🧯 If You Can't Patch
- Restrict admin access to trusted IP addresses only
- Implement network segmentation to limit server's access to internal services
🔍 How to Verify
Check if Vulnerable:
Check if running wuzhicms 4.1.0 with search module enabled. Review admin access logs for suspicious configuration changes.Check Version:
Check wuzhicms version in admin panel or read version.txt in installation directoryVerify Fix Applied:
Verify search module is disabled or input validation is implemented. Test SSRF attempts should fail.📡 Detection & Monitoring
Log Indicators:
- Unusual admin configuration changes to search settings
- Requests to internal services from the wuzhicms server
Network Indicators:
- Outbound connections from wuzhicms server to unexpected internal services
SIEM Query:
source="wuzhicms" AND (event="config_change" OR event="admin_action") AND (parameter="sphinxhost" OR parameter="sphinxport")