CVE-2025-0480: wuzhicms config.php test server-side request forgery

Published Jan 15, 2025

Updated

A vulnerability classified as problematic has been found in wuzhicms 4.1.0. This affects the function test of the file coreframe/app/search/admin/config.php. The manipulation of the argument sphinxhost/sphinxport leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Affected Software

2 affected components

Wuzhicms Wuzhicms

Wuzhicms Wuzhicms=4.1.0

Event History

Jan 15, 2025

CVE Published

via MITRE·05:31 PM

Data Sourced

via MITRE·05:31 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·06:15 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2025-0480?

CVE-2025-0480 is classified as problematic due to its potential for server-side request forgery.

How do I fix CVE-2025-0480?

To fix CVE-2025-0480, it is recommended to update Wuzhi CMS to the latest version that addresses this vulnerability.

What types of attacks can CVE-2025-0480 facilitate?

CVE-2025-0480 can facilitate server-side request forgery attacks which may allow an attacker to access internal services.

Who is affected by CVE-2025-0480?

CVE-2025-0480 affects users of Wuzhi CMS version 4.1.0.

Where can I find more information about CVE-2025-0480?

Additional details about CVE-2025-0480 can be found through security advisories and CVE databases.