Boyuncms

Server-side request forgery in BoyunCMS up to version 1.4.20 allows remote authenticated attackers to issue arbitrary server-side HTTP requests through the payment component's curl processing. Public exploit code is available, though no active exploitation has been confirmed and the EPSS score remains low at 0.04%.

We are tasked with synthesizing a comprehensive analysis for CVE-2025-7102, using all provided data. The output must be a JSON object with specific fields, all plain text strings. We must cross-reference and analyze beyond paraphrasing. I'll go through each field and construct the content. First, review the input data: - CVE ID: CVE-2025-7102 - Description: BoyunCMS up to 1.4.20 has a vulnerability in file application/update/controller/Server.php, manipulation of argument phone leads to SQL injection. Remote attack possible. Exploit disclosed publicly. - CVSS Score: 2.1? But the vector is CVSS:4.0? The vector given: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X That's a CVSS 4.0 vector with low impact (VC:L/VI:L/VA:L), scope unchanged, PR:L (low privileges required), UI:N (no user interaction), AV:N (network). The CVSS score 2.1 is likely a typo or from CVSS 3.1? Actually the vector is 4.0 base metrics: AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L, which would score higher than 2.1. But we'll use the vector as provided? The vector is given, but the "CVSS Score: 2.1" might be an error. However, for our assessed vectors we'll do our own independent assessment. We'll later produce an assessed CVSS 3.1 and 4.0 vector based on analysis. - CWE: CWE-74, which is "Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')" – too broad, SQL injection is more specific. But we'll reference the CWE. - EPSS: 0.05%, percentile 14%. Low probability of exploitation. - KEV status: Not mentioned; likely NO (not in KEV). No KEV data in input. So we assume not actively exploited. - POC: "The exploit has been disclosed to the public and may be used." So publicly available exploit exists. - Tags: PHP, SQLi. - no patch info provided explicitly; patch availability is unknown. - Reported by cna@vuldb.com (VulDB). - CPE: cpe:2.3:a:boyuncms_project:boyuncms:*:*:*:*:*:*:*:* (asterisk indicates all versions). EUVD lists many BoyunCMS versions 1.4.0 to 1.4.20, so up to that. - References: note-hxlab.wetolink.com/share/sEjaSsXWRNz1 (likely POC/exploit), vuldb.com entries. No vendor advisory. Only NVD page via EUVD. So the product is BoyunCMS, a content management system. Not widely known, likely low prevalence. The vulnerability is SQL injection via the 'phone' parameter in application/update/controller/Server.php. The description says "manipulation of the argument phone leads to sql injection". So it's an injection in a parameter presumably used in an SQL query without proper sanitization. The attack can be initiated remotely, requires low privileges (PR:L from CVSS 4.0), no user interaction. So authenticated but low-privileged user could exploit it. Risk assessment: CVSS 4.0 vector indicates low impact (low on CIA) but CVSS score provided is 2.1 (which seems inconsistent). If we compute CVSS 4.0 base score manually: AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L -> Base score around 4.3 maybe? But VC:L/VI:L/VA:L is low, so it's not critical despite being declared critical. The EPSS is very low (0.05%), POC exists but no active exploitation (KEV absent). So real-world risk is relatively low. However, SQL injection can sometimes lead to greater impact if chained, but as described it's low impact. We'll craft a summary, technical context, etc. Ensure not to copy description verbatim. Start summary with specific impact verb: "SQL injection in BoyunCMS". Then explain: what, who, what attacker can do, mention POC, no active exploitation, low EPSS. Technical context: BoyunCMS is a PHP-based CMS. The vulnerability is in the update controller, file Server.php, specifically the phone argument. Based on CWE-74 (injection), likely a parameter used in SQL query without parameterization. The input is handled unsafely, leading to SQL injection. The product CPE indicates all versions up to 1.4.20 affected. No known patch. Risk assessment: Compare signals. CVSS 4.0 vector shows network attack, low complexity, low privileges, low impact on CIA. EPSS extremely low. No KEV, so not actively exploited. POC exists, so threat actors could potentially use it. But impact is limited per CVSS (only low impacts). So real risk is moderate for systems where an authenticated low-privileged user could be malicious. But overall, it's a low severity vulnerability despite being declared critical by source. Affected products: BoyunCMS versions 1.4.0 through 1.4.20 (assuming all 1.4.x). EUVD lists many specific versions, but effectively all 1.4.x. Mention CPE. No vendor advisory links, just the NVD/EUVD page. So no official advisory. References include exploit notes. Remediation: No patch available. Workarounds: restrict access to the update endpoint, disable update controller if possible, or sanitize input via a WAF/mod_security rule. Recommend upgrading when fix available. But the source doesn't provide fix. So we say no vendor-released patch identified. Suggest monitoring VulDB for updates. Exploit scenario: An authenticated attacker with low privileges sends a crafted request to the update functionality, manipulating the phone parameter to inject SQL commands, potentially extracting or modifying data. Exploitation conditions: The attacker must have low-privileged access (as per PR:L). The vulnerable endpoint is the update controller's server.php, specifically the phone argument. The attack is remote over network. So likely requires that the update feature is enabled and accessible. Since it's BoyunCMS, likely admin area? Update functionality may be restricted. So it's not default anonymous access, needs authentication. So condition: authenticated user with low privileges can access the update functionality in BoyunCMS. Attack chain: Access update controller with low-privilege credentials → Craft SQL injection payload in 'phone' parameter → Send request to update endpoint → Malicious SQL queries executed → Low-impact data disclosure/manipulation. Confidence notes: Confirm that exploit is publically disclosed (via note-hxlab link). No vendor fix confirmed. Vulnerable version range from EUVD (up to 1.4.20). EPSS score low. CVSS vector from VulDB. No KEV listing. No vendor advisory found, so patch status unconfirmed. Prevalence: BoyunCMS is an obscure CMS, likely Chinese? Very niche. So prevalence = rare or low. I'll put "rare". Basis: "niche Chinese CMS, minimal enterprise footprint". Assessed CVSS vector: Our independent assessment. The provided CVSS 4.0 gives AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L. For CVSS 3.1 mapping, we need to assess AV:N (because remote), AC:L (no special conditions beyond authentication), PR:L (low privileges), UI:N, scope unchanged? The injection likely affects same component, no scope change. For impact: VC:L (low confidentiality), VI:L (low integrity), VA:L (low availability). So we'd produce CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. But we must consider if confidentiality, integrity, availability are all low? The description doesn't specify, but the 4.0 vector gave those. So we'll use same. Rationale: "Low-privileged user can inject SQL via phone parameter; no user interaction, network vector." But we could argue AC might be low because SQL injection might be trivial. So that's fine. CVSS 4.0 vector: The same as given, but we'll output based on our assessment: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N. No temporal/environmental modifiers. That's consistent. Now construct the JSON. Fields: product_name: "BoyunCMS" summary: "SQL injection in BoyunCMS up to version 1.4.20 allows authenticated low-privileged attackers to manipulate the 'phone' argument in the update controller, leading to potential unauthorized data access or modification. Exploit code is publicly available, but no evidence of active exploitation in the wild. EPSS probability is very low (0.05%), and impact is limited per CVSS scoring, though the vulnerability is labeled critical by the reporter." (ensure starts with impact verb: "SQL injection in BoyunCMS...") technical_context: "BoyunCMS is a PHP-based content management system. The vulnerability resides in the update module at application/update/controller/Server.php, where user-supplied input for the 'phone' parameter is directly incorporated into an SQL query without proper sanitization, as indicated by CWE-74 (Injection). The affected product (cpe:2.3:a:boyuncms_project:boyuncms) includes all versions up to 1.4.20, as confirmed by EUVD enumeration. This typical SQL injection flaw can be exploited by injecting malicious SQL statements through the input field, enabling database query manipulation." risk_assessment: "The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L) indicates a network-accessible flaw requiring low privileges and no user interaction, with only low impact on confidentiality, integrity, and availability. The EPSS score of 0.05% (14th percentile) suggests very low likelihood of exploitation. Despite being tagged critical by the reporter, the actual CVSS base score computed from the 4.0 vector is moderate, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV). Public exploit code exists, but there is no evidence of active exploitation. This combination of signals suggests that while the flaw is real and exploitable, it poses limited immediate risk, especially given its low impact and the need for authenticated access. Defenders should prioritize based on exposure of the CMS's update functionality to low-privileged users." affected_products: "BoyunCMS versions 1.4.0 to 1.4.20 are affected, as detailed by EUVD (e.g., 1.4.0, 1.4.13, 1.4.20, etc.). The CPE designation cpe:2.3:a:boyuncms_project:boyuncms:* confirms all versions prior to a fix are vulnerable. No official vendor advisory has been published; the primary reference is the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2025-7102 and VulDB at https://vuldb.com/?id.315016." remediation: "No vendor-released patch is currently available. As a temporary mitigation, restrict access to the update endpoint (Server.php) to trusted users only, or disable the update module if not needed. Apply strict input validation for the 'phone' parameter using a web application firewall (WAF) rule to block SQL injection patterns. Monitor the VulDB entry (https://vuldb.com/?id.315016) for a fix and upgrade promptly once a patched version is released. Note that disabling the update feature may break update functionality, so weigh operational needs." exploit_scenario: "A low-privileged authenticated attacker crafts a request to the BoyunCMS update endpoint containing a SQL injection payload in the 'phone' parameter. Successful exploitation could allow extraction of database contents or modification of data within the CMS database, depending on the injected query." exploitation_conditions: "Exploitation requires network access to the BoyunCMS instance and authentication with low privileges (as indicated by CVSS PR:L). The vulnerable endpoint is application/update/controller/Server.php, which must be exposed and accessible. No special configuration beyond the default CMS deployment is needed, but the attacker must have valid credentials with sufficient permission to use the update feature. The attack does not require user interaction."

Unrestricted file upload in BoyunCMS up to version 1.4.20 allows remote attackers to upload arbitrary files via the image parameter in /application/user/controller/Index.php. Exploit code is publicly available, but EPSS indicates low exploitation probability (0.08%) and no active exploitation in CISA KEV.

BoyunCMS up to version 1.21 on PHP7 is vulnerable to deserialization via the db_host parameter in the installation