Post

Yzmcms Background Acquisition Module Ssrf Vulnerability

Posted
By Rhy0z
1 min read
Yzmcms Background Acquisition Module Ssrf Vulnerability

YzmCMS background acquisition module SSRF vulnerability

Vulnerability Description

YzmCMS Content Management System is a lightweight open source content management system which is developed using the independent research and development framework YZMPHP.

The source code has a defect in protocol identification, resulting in an SSRF vulnerability

Vulnerability Impact

YzmCMS version < V5.8 official version

Environment construction

</a-alert>

img

Vulnerability reappears

Log in to the background –> Module management –> Collection management

img

Add collection rules

img

Edit HTML code on your server

img

The root directory may be different, the payload needs to be changed

Click to collect and read the flag in the root directory

img

The code location where the vulnerability occurs yzmcms/yzmphp/core/class/cache_factory.class.php

img

Call the *url_check* function here

img

You can see that only the first 4 digits are http. You can bypass it by using httpxxx

This post is licensed under CC BY 4.0 by the author.