CVE-2025-2997 - zhangyanbo2007 youkefu url server-side request forgery

Back Back to CVE browser

MEDIUM

zhangyanbo2007 youkefu url server-side request forgery

Published Mar 31, 2025

5.3

MEDIUM

CVSS 4.0

EPSS 0.53%

Description

A vulnerability was found in zhangyanbo2007 youkefu 4.2.0. It has been classified as critical. Affected is an unknown function of the file /res/url. The manipulation of the argument url leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Affected products

Vendor Zhangyanbo2007 Product Youkefu Default
n/a
- Version
  4.2.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Zhangyanbo2007

Youkefu

n/a

Version	Status	Constraints
4.2.0	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-918

SSRF

References (5)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-8779
Advisory
https://github.com/exp3n5ive/Vul/blob/main/youkefu/youkefu.pdf
exploitThird Party Advisory
https://vuldb.com/?ctiid.302046
signaturepermissions-requiredPermissions RequiredVDB Entry
https://vuldb.com/?id.302046
vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry
https://vuldb.com/?submit.524009
third-party-advisoryThird Party AdvisoryVDB Entry

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-8779		Advisory
https://github.com/exp3n5ive/Vul/blob/main/youkefu/youkefu.pdf		exploitThird Party Advisory
https://vuldb.com/?ctiid.302046		signaturepermissions-requiredPermissions RequiredVDB Entry
https://vuldb.com/?id.302046		vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry
https://vuldb.com/?submit.524009		third-party-advisoryThird Party AdvisoryVDB Entry