Listen to this Post
How the CVE Works
CVE-2025-45475 is an SSRF vulnerability in maccms10’s Friend Link Management module. The flaw allows attackers to craft malicious requests through insufficient input validation, enabling them to bypass security restrictions and interact with internal systems. By manipulating URL parameters, an attacker can force the server to make unauthorized requests to internal or external systems, potentially leading to data exposure, internal network scanning, or remote code execution. The vulnerability arises due to improper sanitization of user-supplied URLs in the `friendlink.php` endpoint, which fails to validate or restrict access to sensitive resources.
DailyCVE Form
Platform: maccms10
Version: v2025.1000.4047
Vulnerability: SSRF
Severity: Critical
Date: 06/24/2025
Prediction: Patch by 07/15/2025
What Undercode Say
curl -X POST "http://target/friendlink.php" -d "url=http://internal-server/admin"
import requests
payload = {"url": "file:///etc/passwd"}
requests.post("http://target/friendlink.php", data=payload)
How Exploit
- Craft malicious SSRF payloads via
friendlink.php. - Exploit internal services or read local files.
- Chain with other vulnerabilities for RCE.
Protection from this CVE
- Input validation for URLs.
- Restrict outbound requests.
- Update to patched version.
Impact
- Data leakage.
- Internal network compromise.
- Remote code execution.
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
