CVE-2025-8772
📋 TL;DR
This vulnerability allows attackers to perform server-side request forgery (SSRF) attacks against NukeViet CMS installations. Attackers can manipulate the module handler's upload functionality to make the server send requests to internal or external systems. All NukeViet installations up to version 4.5.06 are affected.
💻 Affected Systems
- Vinades NukeViet
📦 What is this software?
Nukeviet by Nukeviet
⚠️ Risk & Real-World Impact
Worst Case
Attackers could access internal services, exfiltrate sensitive data, or use the vulnerable server as a proxy for attacks against other systems.
Likely Case
Information disclosure from internal services, port scanning of internal networks, or limited data exfiltration.
If Mitigated
Limited impact if network segmentation restricts internal service access and egress filtering blocks external requests.
🎯 Exploit Status
Exploit details are publicly available, and the vulnerability requires admin access to the /admin/index.php endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Consider upgrading to the latest version if it addresses this vulnerability, or implement workarounds.
🔧 Temporary Workarounds
Restrict Admin Access
allLimit access to the /admin/ directory to trusted IP addresses only
# Apache: <Location /admin/>
# Require ip 192.168.1.0/24
# </Location>
# Nginx: location /admin/ {
# allow 192.168.1.0/24;
# deny all;
# }
Input Validation
allAdd validation to reject URLs in the vulnerable parameter
# In /admin/index.php, add validation for the 'nv' parameter
# Example: if (isset($_GET['nv']) && strpos($_GET['nv'], 'upload') !== false) {
# // Validate and sanitize input
# }
🧯 If You Can't Patch
- Implement network segmentation to isolate the NukeViet server from sensitive internal services
- Deploy a web application firewall (WAF) with SSRF protection rules
🔍 How to Verify
Check if Vulnerable:
Check if your NukeViet version is 4.5.06 or earlier and if the /admin/index.php?language=en&nv=upload endpoint is accessibleCheck Version:
Check the NukeViet version in the admin panel or look for version information in the source codeVerify Fix Applied:
Test if SSRF attempts through the vulnerable endpoint are blocked or properly validated📡 Detection & Monitoring
Log Indicators:
- Unusual requests to /admin/index.php with 'nv=upload' parameter containing URLs
- Outbound requests from the server to unusual internal or external IPs
Network Indicators:
- Unexpected outbound connections from the web server to internal services
SIEM Query:
web.url:"/admin/index.php" AND web.param:"nv=upload" AND (web.param:"http://" OR web.param:"https://")