ByteOS Network

CVE Vulnerability Details :

CVE-2025-2997

PUBLISHED

More Info Official Page

Assigner-VulDB

Assigner Org ID-1af790b2-7ee1-4545-860a-a788eba489b5

Published At-31 Mar, 2025 | 13:31

Updated At-31 Mar, 2025 | 14:27

▼CVE Numbering Authority (CNA)

zhangyanbo2007 youkefu url server-side request forgery

A vulnerability was found in zhangyanbo2007 youkefu 4.2.0. It has been classified as critical. Affected is an unknown function of the file /res/url. The manipulation of the argument url leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Affected Products

Vendor

zhangyanbo2007

Product

youkefu

Versions

Affected

4.2.0

Problem Types

Type	CWE ID	Description
CWE	CWE-918	Server-Side Request Forgery

Metrics

Version	Base score	Base severity	Vector
4.0	5.3	MEDIUM	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
3.1	6.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
3.0	6.3	MEDIUM	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
2.0	6.5	N/A	AV:N/AC:L/Au:S/C:P/I:P/A:P

Credits

reporter

exp3n5ive (VulDB User)

Timeline

Event	Date
Advisory disclosed	2025-03-30 00:00:00
VulDB entry created	2025-03-30 01:00:00
VulDB entry last update	2025-03-30 19:35:13

References

Hyperlink	Resource
https://vuldb.com/?id.302046	vdb-entry technical-description
https://vuldb.com/?ctiid.302046	signature permissions-required
https://vuldb.com/?submit.524009	third-party-advisory
https://github.com/exp3n5ive/Vul/blob/main/youkefu/youkefu.pdf	exploit

▼Authorized Data Publishers (ADP)

CISA ADP Vulnrichment

Affected Products

Affected

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

Affected Products

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References