Is there a public PoC exploit available for CVE-2025-15373?

Yes, a public proof-of-concept exploit is available for CVE-2025-15373. Prioritise patching immediately. EPSS: 0.0%.

EyouCMS CVE-2025-15373

Q: What is the CVSS score of CVE-2025-15373?

CVE-2025-15373 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

LOW

Server-Side Request Forgery (SSRF) (CWE-918)

2025-12-31 cna@vuldb.com

PHP SSRF Eyoucms

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Apr 29, 2026 - 01:45 vuln.today

DescriptionCVE.org

A security vulnerability has been detected in EyouCMS up to 1.7.7. Impacted is the function saveRemote of the file application/function.php. Such manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor is "[a]cknowledging the existence of the vulnerability, we have completed the fix and will release a new version, v1.7.8".

AnalysisAI

Server-side request forgery (SSRF) in EyouCMS versions up to 1.7.7 allows authenticated remote attackers to manipulate the saveRemote function in application/function.php, enabling arbitrary HTTP requests from the server. The vulnerability carries low confidentiality, integrity, and availability impact but is publicly exploitable with proof-of-concept code available. Vendor has acknowledged the flaw and committed to releasing patched version 1.7.8.

Technical ContextAI

EyouCMS is a PHP-based content management system. The vulnerability exists in the saveRemote function within application/function.php, which handles remote file operations. The root cause is CWE-918 (Server-Side Request Forgery), a class of vulnerabilities where application-controlled URLs or requests are not properly validated before being executed by the server. This allows attackers to abuse the server's network access to reach internal services, perform port scanning, or exfiltrate data from restricted network segments. The SSRF vector here is particularly relevant in scenarios where the CMS server has access to internal infrastructure, cloud metadata endpoints (AWS, GCP, Azure), or other backend services not directly accessible from the internet.

RemediationAI

Upgrade EyouCMS to version 1.7.8 or later when released by the vendor. Until the patched version is available, implement network-level compensating controls: restrict outbound HTTP/HTTPS traffic from the EyouCMS application server using firewall rules or egress filtering, blocking access to internal IP ranges (RFC 1918), cloud metadata endpoints (169.254.169.254 for AWS/GCP), and 127.0.0.1/::1. Alternatively, disable or restrict the saveRemote function if not critical to operations-consult vendor documentation for feature dependencies. Additionally, enforce strict authentication mechanisms and audit logs for all remote file operations; consider implementing Web Application Firewall rules to detect and block SSRF patterns in request parameters (e.g., URLs containing internal IPs or localhost). Monitor the official EyouCMS repository or release notes at https://vuldb.com/?id.339081 for version 1.7.8 availability. Network restrictions are most effective; function disablement carries operational risk if the feature is required for content workflows.