CVE-2025-2997

MediumPublic PoC

Published: 31 March 2025

Published

31 March 2025

Modified

10 October 2025

KEV Added

—

Patch

—

CVSS Score v4 5.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Score 0.0022 45.2th percentile

Risk Priority 11 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-2997 is a medium-severity SSRF (CWE-918) vulnerability in Zhangyanbo2007 Youkefu. Its CVSS base score is 5.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 45.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 AC-4 (Information Flow Enforcement) and SC-7 (Boundary Protection).

Deeper analysis

CVE-2025-2997 is a server-side request forgery (SSRF) vulnerability, classified under CWE-918, affecting zhangyanbo2007 youkefu version 4.2.0. The flaw resides in an unknown function within the file /res/url, where manipulation of the "url" argument triggers the SSRF. Published on 2025-03-31, it has been rated critical with a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).

A remote attacker possessing low privileges (PR:L) can exploit this vulnerability over the network with low complexity and no user interaction required. Exploitation enables limited impacts on confidentiality, integrity, and availability (C:L/I:L/A:L) via SSRF, allowing the attacker to make unauthorized requests from the server.

VulDB advisories (ctiid.302046, id.302046, submit.524009) document the issue, while a GitHub repository at https://github.com/exp3n5ive/Vul/blob/main/youkefu/youkefu.pdf discloses a public exploit that may be used by attackers. No specific patches or mitigations are detailed in the provided references.

The exploit disclosure heightens the risk, as it is publicly available for potential weaponization.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-8779

Vulnerability details

A vulnerability was found in zhangyanbo2007 youkefu 4.2.0. It has been classified as critical. Affected is an unknown function of the file /res/url. The manipulation of the argument url leads to server-side request forgery. It is possible to launch the…

attack remotely. The exploit has been disclosed to the public and may be used.

CWE(s): CWE-918

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1046 Network Service Discovery Discovery

Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vulnerable to remote software exploitation.

attack.mitre.org →

Why these techniques?

SSRF in public-facing web endpoint (/res/url) enables exploitation of public-facing applications (T1190) and facilitates internal network service discovery (T1046) by abusing server-side request capabilities.