CVE-2025-61488
BaseFortify
Publication date: 2025-10-20
Last updated on: 2025-10-21
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| slims | slims | 9.6.1 |
| openssl | openssl | 3.1.3 |
| apache | http_server | 2.4.58 |
| php | php | 8.2.12 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-918 | The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. |
| CWE-94 | The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Server-Side Request Forgery (SSRF) in the Senayan Library Management System (SLiMS) version 9.6.1, specifically in the scrape_image.php component. It occurs because the application improperly validates the user-supplied 'imageURL' parameter, allowing an attacker to make the server send HTTP requests to arbitrary locations. This can lead to the server accessing internal or restricted network resources and, in some cases, executing arbitrary code. [1]
How can this vulnerability impact me? :
An attacker exploiting this vulnerability can cause the server to make unauthorized HTTP requests to internal or external systems, potentially accessing sensitive data or internal network resources. This may lead to information disclosure or, in some cases, arbitrary code execution on the server, which can compromise the security and integrity of the affected system. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for suspicious POST requests to the scrape_image.php endpoint with the imageURL parameter. For example, you can use network monitoring tools or web server logs to identify POST requests containing the imageURL parameter pointing to external or unusual URLs. A simple command to search web server logs for such requests could be: grep 'POST /slimspoc/admin/modules/bibliography/scrape_image.php' /path/to/access.log | grep 'imageURL=' Additionally, you can use tools like curl to test the endpoint manually: curl -X POST -d 'imageURL=http://example.com/malicious_image' http://yourserver/slimspoc/admin/modules/bibliography/scrape_image.php Monitoring for unexpected outbound HTTP requests from the server to internal or external addresses triggered by this parameter can also help detect exploitation attempts. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include: 1. Restrict the URL schemes accepted by the imageURL parameter to only 'http' and 'https'. 2. Block requests to private, internal, or loopback IP addresses by resolving the hostname and validating the IP against private ranges. 3. Enforce limits on the size of the fetched content (e.g., max 2 MB) and validate that the content is a valid image by checking MIME type. 4. Optionally, implement a whitelist of trusted domains for the imageURL parameter. If you cannot immediately patch the application, consider restricting access to the vulnerable endpoint via firewall rules or web server configuration to limit exposure. [1]