CVE-2025-9402 - HuangDou UTCMS Config update.php server-side request forgery

Back Back to CVE browser

MEDIUM

HuangDou UTCMS Config update.php server-side request forgery

Published Aug 25, 2025

5.1

MEDIUM

CVSS 4.0

EPSS 0.36%

Description

A vulnerability was found in HuangDou UTCMS 9. This issue affects some unknown processing of the file app/modules/ut-frame/admin/update.php of the component Config Handler. Performing manipulation of the argument UPDATEURL results in server-side request forgery. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products

Vendor HuangDou Product Utcms Default
n/a
- Version
  9
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

HuangDou

Utcms

n/a

Version	Status	Constraints
9	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-918

SSRF

References (6)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-25654
Advisory
https://github.com/August829/Yu/blob/main/20250811_1.md
relatedBroken Link
https://github.com/August829/Yu/blob/main/20250811_1.md#poc
exploitBroken Link
https://vuldb.com/?ctiid.321238
signaturepermissions-requiredPermissions RequiredVDB Entry
https://vuldb.com/?id.321238
vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry
https://vuldb.com/?submit.632537
third-party-advisoryThird Party AdvisoryVDB Entry

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-25654		Advisory
https://github.com/August829/Yu/blob/main/20250811_1.md		relatedBroken Link
https://github.com/August829/Yu/blob/main/20250811_1.md#poc		exploitBroken Link
https://vuldb.com/?ctiid.321238		signaturepermissions-requiredPermissions RequiredVDB Entry
https://vuldb.com/?id.321238		vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry
https://vuldb.com/?submit.632537		third-party-advisoryThird Party AdvisoryVDB Entry