CVE-2025-9402 MEDIUM

CVE-2025-9402: HuangDou UTCMS Config update.php server-side request forgery

Vendor Huangdou
Product UTCMS
Weakness CWE-918 · SSRF
Published August 25, 2025
Last update August 25, 2025
View on NVD All CVEs

CVSS base score

5.1/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

What the vulnerability does

01Description

A vulnerability was found in HuangDou UTCMS 9. This issue affects some unknown processing of the file app/modules/ut-frame/admin/update.php of the component Config Handler. Performing manipulation of the argument UPDATEURL results in server-side request forgery. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Key dates

02Disclosure timeline

August 25, 2025 CVE published
August 25, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-33752 Redirect-based SSRF leading to internal network access in curl_cffi (with TLS impersonation bypass) CVE-2025-15098 YunaiV yudao-cloud Business Process Management BpmSyncHttpRequestTrigger server-side request forgery CVE-2023-29260 IBM Sterling Connect:Express for UNIX server-side request forgery CVE-2022-0768 Server-Side Request Forgery (SSRF) in rudloff/alltube CVE-2025-5005 Shanghai Lingdang Information Technology Lingdang CRM index_event.php server-side request forgery