CVE-2025-10765
📋 TL;DR
This vulnerability allows remote attackers to perform server-side request forgery (SSRF) attacks against SeriaWei ZKEACMS installations up to version 4.3. Attackers can manipulate the CheckPage/Suggestions function in the SEOSuggestions component to make the server send unauthorized requests to internal or external systems. Organizations using ZKEACMS versions 4.3 and earlier are affected.
💻 Affected Systems
- SeriaWei ZKEACMS
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could use the vulnerable server as a proxy to attack internal systems, access cloud metadata services, perform port scanning of internal networks, or interact with internal APIs that shouldn't be exposed externally.
Likely Case
Attackers will likely use this to scan internal networks, access internal web applications, or exfiltrate data from internal services that accept HTTP requests.
If Mitigated
With proper network segmentation and egress filtering, the impact is limited to the vulnerable server itself and any directly accessible internal services.
🎯 Exploit Status
The exploit has been released to the public according to the disclosure. The vulnerability appears to be remotely exploitable without authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch is available as the vendor did not respond to disclosure. Consider upgrading to any version above 4.3 if available, or apply workarounds.
🔧 Temporary Workarounds
Disable SEOSuggestions Plugin
allRemove or disable the vulnerable ZKEACMS.SEOSuggestions.dll plugin to prevent exploitation
Move or delete: cms-v4.3\wwwroot\Plugins\ZKEACMS.SEOSuggestions\ZKEACMS.SEOSuggestions.dll
Network Egress Filtering
allImplement strict outbound firewall rules to limit the server's ability to make requests to internal networks
🧯 If You Can't Patch
- Implement strict network segmentation to isolate the ZKEACMS server from sensitive internal systems
- Deploy a web application firewall (WAF) with SSRF protection rules to block exploitation attempts
🔍 How to Verify
Check if Vulnerable:
Check if the file cms-v4.3\wwwroot\Plugins\ZKEACMS.SEOSuggestions\ZKEACMS.SEOSuggestions.dll exists and your ZKEACMS version is 4.3 or earlierCheck Version:
Check the ZKEACMS administration panel or examine the application files for version informationVerify Fix Applied:
Verify the SEOSuggestions.dll file has been removed or disabled, and test that the CheckPage/Suggestions endpoint no longer responds📡 Detection & Monitoring
Log Indicators:
- Unusual outbound HTTP requests from the ZKEACMS server to internal IP addresses
- Requests to the CheckPage/Suggestions endpoint with URL parameters
Network Indicators:
- HTTP traffic from the ZKEACMS server to unexpected internal destinations
- Requests to cloud metadata endpoints (169.254.169.254, etc.)
SIEM Query:
source_ip="ZKEACMS_SERVER_IP" AND (dest_ip IN [INTERNAL_RANGES] OR dest_ip="169.254.169.254")