CVE-2025-5327
📋 TL;DR
This critical SSRF vulnerability in chshcms mccms 2.7 allows attackers to manipulate the 'pic' parameter to make the server send unauthorized requests to internal or external systems. It affects all installations of mccms 2.7 with the vulnerable API endpoint exposed. Remote attackers can exploit this without authentication.
💻 Affected Systems
- chshcms mccms
📦 What is this software?
Mccms by Chshcms
⚠️ Risk & Real-World Impact
Worst Case
Attackers could access internal services, exfiltrate sensitive data, perform port scanning of internal networks, or chain with other vulnerabilities to achieve remote code execution.
Likely Case
Information disclosure from internal services, potential data exfiltration, and abuse of server resources for scanning or attacking other systems.
If Mitigated
Limited to probing internal network structure if proper network segmentation and egress filtering are in place.
🎯 Exploit Status
Public exploit documentation exists in Chinese, showing simple HTTP request manipulation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None
Restart Required: No
Instructions:
No official patch available. Vendor did not respond to disclosure. Consider upgrading to a newer version if available or applying workarounds.
🔧 Temporary Workarounds
Block vulnerable endpoint
allRestrict access to the vulnerable API endpoint using web server configuration or firewall rules.
# Apache: RewriteRule ^sys/apps/controllers/api/Gf.php - [F]
# Nginx: location ~ ^/sys/apps/controllers/api/Gf.php { deny all; }
Input validation filter
allAdd server-side validation to reject URLs in the 'pic' parameter that point to internal or non-whitelisted domains.
# PHP example: if(preg_match('/^(http|https):\/\/(localhost|127\.|192\.168\.|10\.|172\.(1[6-9]|2[0-9]|3[0-1])\.)/', $_GET['pic'])) { die('Invalid URL'); }
🧯 If You Can't Patch
- Implement strict network egress filtering to prevent the server from reaching internal services.
- Deploy a Web Application Firewall (WAF) with SSRF protection rules to block malicious requests.
🔍 How to Verify
Check if Vulnerable:
Send a request to /sys/apps/controllers/api/Gf.php?pic=http://internal-service and check if server attempts to connect.Check Version:
Check CMS version in admin panel or configuration files; look for 'mccms 2.7'.Verify Fix Applied:
Test the same request after applying workarounds; it should be blocked or return an error.📡 Detection & Monitoring
Log Indicators:
- Unusual outbound HTTP requests from server to internal IPs
- Requests to /sys/apps/controllers/api/Gf.php with URL parameters
Network Indicators:
- Server making unexpected HTTP requests to internal network segments
SIEM Query:
source="web_server" AND (uri="/sys/apps/controllers/api/Gf.php" OR outbound_dest_ip IN (RFC1918_IPs))