Vulnerabilities > CVE-2022-40357 - Server-Side Request Forgery (SSRF) vulnerability in Zblogcn Z-Blogphp

CVSS 9.8 - CRITICAL

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

low complexity

zblogcn

CWE-918

critical

NVD

Published: 2022-09-20

Updated: 2022-09-22

Summary

A security issue was discovered in Z-BlogPHP <= 1.7.2. A Server-Side Request Forgery (SSRF) vulnerability in the zb_users/plugin/UEditor/php/action_crawler.php file allows remote attackers to force the application to make arbitrary requests via injection of arbitrary URLs into the source parameter.

Vulnerable Configurations

Part	Description	Count
Application	Zblogcn Zblogcn Z Blogphp 1.5 Zblogcn Z Blogphp 1.5.0.1525 Zblogcn Z Blogphp 1.5.0.1525-2 Zblogcn Z Blogphp 1.5.0.1525-3 Zblogcn Z Blogphp 1.5.0.1525-4 Zblogcn Z Blogphp 1.5.0.1525-5 Zblogcn Z Blogphp 1.5.0.1525-6 Zblogcn Z Blogphp 1.5.0.1525-7 Zblogcn Z Blogphp 1.5.0.1525-8 Zblogcn Z Blogphp 1.5.0.1626 Zblogcn Z Blogphp 1.5.1 Zblogcn Z Blogphp 1.5.1.1740 Zblogcn Z Blogphp 1.5.2 Zblogcn Z Blogphp 1.5.2.1935 Zblogcn Z Blogphp 1.5.2.1935\(Zero\) Zblogcn Z Blogphp 1.6.0 Zblogcn Z Blogphp 1.6.1 Zblogcn Z Blogphp 1.6.1.2100 Zblogcn Z Blogphp 1.7.2	26

Common Weakness Enumeration (CWE)

CWE-918 - Server-Side Request Forgery (SSRF)

References

https://github.com/zblogcn/zblogphp/issues/336