SecBoard
Zurück zur CVE-Übersicht

CVE-2025-50234

MEDIUM(6.5)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Risk Signal Score16/100 — NIEDRIG
  • CVSS 6.5 — Mittel

EPSS-Score

0.2%

Exploit-Wahrscheinlichkeit (30 Tage)

CVSS Score

6.5

Technische Schwere

Beschreibung

MCCMS v2.7.0 has an SSRF vulnerability located in the index() method of the sys\apps\controllers\api\Gf.php file, where the pic parameter is processed. The pic parameter is decrypted using the sys_auth($pic, 1) function, which utilizes a hard-coded key Mc_Encryption_Key (bD2voYwPpNuJ7B8), defined in the db.php file. The decrypted URL is passed to the geturl() method, which uses cURL to make a request to the URL without proper security checks. An attacker can craft a malicious encrypted pic parameter, which, when decrypted, points to internal addresses or local file paths (such as http://127.0.0.1 or file://). By using the file:// protocol, the attacker can access arbitrary files on the local file system (e.g., file:///etc/passwd, file:///C:/Windows/System32/drivers/etc/hosts), allowing them to read sensitive configuration files, log files, and more, leading to information leakage or system exposure. The danger of this SSRF vulnerability includes accessing internal services and local file systems through protocols like http://, ftp://, and file://, which can result in sensitive data leakage, remote code execution, privilege escalation, or full system compromise, severely affecting the system's security and stability.

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Threat-Hunting-Queries

Detects attempts to access internal resources or local files via the 'pic' parameter, indicative of SSRF exploitation. Adjust 'your_mccms_webserver_logs' to your actual log source.

Sentinel/Defender KQL

your_mccms_webserver_logs
| where Url contains "/index.php/api/gf/" and Url contains "pic="
| where Url matches regex "(http://127.0.0.1|file:///|ftp://)" // Refine regex for specific internal IP ranges if known
| project TimeGenerated, Computer, Url, SourceIp

Splunk SPL

your_mccms_webserver_logs /index.php/api/gf/ pic= (http://127.0.0.1 OR file:/// OR ftp://) | table _time, host, uri, clientip

Sigma

title: MCCMS SSRF Attempt
id: 00000000-0000-0000-0000-000000000001
status: experimental
description: Detects attempts to exploit SSRF vulnerability in MCCMS via 'pic' parameter.
author: SecBoard
date: 2024/07/30
logsource:
  category: webserver
  product: mccms
detection:
  selection:
    url|contains: '/index.php/api/gf/'
    url|contains:
      - 'pic='
      - 'http://127.0.0.1'
      - 'file:///'
      - 'ftp://'
  condition: selection
fields:
  - url
  - source_ip
level: high

Elastic ES|QL

FROM your_mccms_webserver_logs
WHERE url.path : "/index.php/api/gf/" AND url.query : "pic=" AND (url.full : "http://127.0.0.1" OR url.full : "file:///" OR url.full : "ftp://")
SELECT @timestamp, host.name, url.full, source.ip

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Indikatoren

Domains (1)

  • www.mccms.com

Übernommen wurden nur Indikatoren, die wörtlich in einer Hersteller- oder Research-Quelle standen.

Betroffene Produkte

  • cpe:2.3:a:chshcms:mccms:2.7:*:*:*:*:*:*:*

Referenzen