CVE-2024-25187

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-25187
Server Side Request Forgery (SSRF) vulnerability in 71cms v1.0.0, allows remote unauthenticated attackers to obtain sensitive information via getweather.html.

8.6 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 4.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://gist.github.com/wisejayer/d365e93ce09b8a36641165e1d1a0a06c Third Party Advisory
https://github.com/xiaocheng-keji/71cms/issues/2 Broken Link Exploit
https://gist.github.com/wisejayer/d365e93ce09b8a36641165e1d1a0a06c Third Party Advisory
https://github.com/xiaocheng-keji/71cms/issues/2 Broken Link Exploit
Configurations

Configuration 1 (hide)

cpe:2.3:a:xiaocheng-keji:71cms:1.0:*:*:*:*:*:*:*
History

10 Jun 2025, 00:46

Type Values Removed Values Added
CPE cpe:2.3:a:xiaocheng-keji:71cms:1.0:*:*:*:*:*:*:*
First Time Xiaocheng-keji 71cms
Xiaocheng-keji
References () https://gist.github.com/wisejayer/d365e93ce09b8a36641165e1d1a0a06c - () https://gist.github.com/wisejayer/d365e93ce09b8a36641165e1d1a0a06c - Third Party Advisory
References () https://github.com/xiaocheng-keji/71cms/issues/2 - () https://github.com/xiaocheng-keji/71cms/issues/2 - Broken Link, Exploit

21 Nov 2024, 09:00

Type Values Removed Values Added
References () https://gist.github.com/wisejayer/d365e93ce09b8a36641165e1d1a0a06c - () https://gist.github.com/wisejayer/d365e93ce09b8a36641165e1d1a0a06c -
References () https://github.com/xiaocheng-keji/71cms/issues/2 - () https://github.com/xiaocheng-keji/71cms/issues/2 -

28 Aug 2024, 20:35

Type Values Removed Values Added
CWE CWE-918
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 8.6

02 Apr 2024, 12:50

Type Values Removed Values Added
Summary
  • (es) La vulnerabilidad de Server Side Request Forgery (SSRF) en 71cms v1.0.0 permite a atacantes remotos no autenticados obtener información confidencial a través de getweather.html.

02 Apr 2024, 04:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-04-02 04:15

Updated : 2025-06-10 00:46

NVD link : CVE-2024-25187

Mitre link : CVE-2024-25187

CVE.ORG link : CVE-2024-25187

JSON object : View

Products Affected

xiaocheng-keji

  • 71cms
CWE
CWE-918

Server-Side Request Forgery (SSRF)