Description
A vulnerability was detected in ZKEACMS 4.3. Impacted is the function Proxy of the file src/ZKEACMS/Controllers/MediaController.cs. Performing manipulation of the argument url results in server-side request forgery. It is possible to initiate the attack remotely. The exploit is now public and may be used.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | ZKEACMS | 4.3 | — |
References
- VDB-323890 | ZKEACMS MediaController.cs Proxy server-side request forgery vdb-entry technical-description
- VDB-323890 | CTI Indicators (IOB, IOC, IOA) signature permissions-required
- Submit #648387 | SeriaWei ZKEACMS v4.3 Non-blind SSRF third-party-advisory
- https://github.com/August829/Yu/blob/main/58ead8e7e08bfb022.md related
- https://github.com/August829/Yu/blob/main/58ead8e7e08bfb022.md#poc exploit