CVE-2025-5005
BaseFortify
Publication date: 2025-09-09
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| 51mis | lingdang_crm | to 8.6.5.4 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-918 | The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-5005 is a server-side request forgery (SSRF) vulnerability in Shanghai Lingdang Information Technology's Lingdang CRM versions up to 8.6.5.4. It exists in the file crm/WeiXinApp/dingtalk/index_event.php, specifically involving the manipulation of the 'corpurl' parameter. An attacker can remotely and without authentication manipulate this parameter to make the server send unauthorized requests to arbitrary URLs. This can bypass expected destination checks and allows attackers to potentially access internal services or redirect users to malicious sites. The vulnerability is easy to exploit due to a public proof-of-concept exploit being available. [1, 3]
How can this vulnerability impact me? :
This vulnerability can impact you by compromising the confidentiality, integrity, and availability of your system. Attackers can remotely exploit it without authentication to make your server send unauthorized requests, potentially accessing internal services that should be protected. This can lead to unauthorized data access, modification, or disruption of services. Additionally, attackers can use it to redirect users to malicious websites, enabling phishing or other attacks. Since no official patches or mitigations are available, the risk remains significant. [1, 2, 3]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by searching for the vulnerable URL pattern in your web application, specifically URLs containing 'crm/WeiXinApp/dingtalk/index_event.php'. Google dorking with the query 'inurl:crm/WeiXinApp/dingtalk/index_event.php' can help identify exposed instances. Additionally, you can test the vulnerability by sending a request with a crafted 'corpurl' parameter and monitoring DNS logs for outbound requests triggered by the server. For example, you can use curl to send a test request: curl 'http://<target>/crm/WeiXinApp/dingtalk/index_event.php?corpurl=http://your-dns-log-domain'. Monitoring DNS logs for requests to 'your-dns-log-domain' confirms exploitation attempts. [1, 3]
What immediate steps should I take to mitigate this vulnerability?
No official patches or mitigations are currently available for this vulnerability. Immediate steps include replacing the affected Lingdang CRM product with an alternative solution not affected by this issue. Additionally, restrict external access to the vulnerable URL path if possible, and monitor network traffic for suspicious outbound requests originating from the vulnerable server. Applying network-level controls to block unauthorized outbound requests may reduce risk until a patch or fix is available. [1]