CVE-2025-25785
Published: 26 February 2025
Summary
CVE-2025-25785 is a critical-severity SSRF (CWE-918) vulnerability in Jizhicms Jizhicms. Its CVSS base score is 9.1 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 34.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-4 (Information Flow Enforcement) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires validation of all information inputs to prevent crafted requests from triggering unauthorized server-side requests to internal intranet resources.
Enforces policy-based restrictions on information flows, blocking application-initiated requests to unauthorized internal destinations exploited by SSRF.
Monitors and controls communications at boundaries to block or detect SSRF attempts accessing internal network services.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SSRF in public-facing web app directly enables remote exploitation (T1190) and facilitates internal network service discovery via crafted requests (T1046).
NVD Description
JizhiCMS v2.5.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the component \c\PluginsController.php. This vulnerability allows attackers to perform an intranet scan via a crafted request.
Deeper analysisAI
CVE-2025-25785 is a Server-Side Request Forgery (SSRF) vulnerability affecting JizhiCMS version 2.5.4, specifically within the \c\PluginsController.php component. This flaw enables attackers to conduct intranet scans through a crafted request, as documented under CWE-918. The vulnerability carries a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), indicating critical severity due to its network accessibility, low attack complexity, lack of required privileges or user interaction, and high impacts on confidentiality and integrity.
Remote, unauthenticated attackers can exploit this vulnerability by sending specially crafted requests to the affected JizhiCMS instance. Successful exploitation allows them to perform intranet scans, potentially accessing internal network resources, services, or metadata that would otherwise be inaccessible from the internet. The high confidentiality and integrity impacts suggest broader risks, such as unauthorized data exfiltration or manipulation of internal systems reachable via the SSRF.
Vendor references are available at http://jizhicms.com and https://www.jizhicms.cn/, which security practitioners should consult for any advisories, patches, or mitigation guidance related to this vulnerability in JizhiCMS v2.5.4. The CVE was published on 2025-02-26T15:15:26.720.
Details
- CWE(s)