CVE-2025-5140
Seeyon Zhiyuan OA Web Application System ThirdMenuController.class this.oursNetService.getData server-side request forgery
- State
- Published
- Severity
- 5.3 Medium
- Published
- May 25, 2025
- Updated
- May 28, 2025
- Reserved
- May 23, 2025
Description
A vulnerability classified as critical has been found in Seeyon Zhiyuan OA Web Application System up to 8.1 SP2. This affects the function this.oursNetService.getData of the file com\ours\www\ehr\openPlatform1\open4ClientType\controller\ThirdMenuController.class. The manipulation of the argument url leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N | VulDB |
| 3.1 | 6.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L | VulDB |
| 3.0 | 6.3 Medium | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L | VulDB |
| 2.0 | 6.5 Medium | AV:N/AC:L/Au:S/C:P/I:P/A:P | VulDB |
Weaknesses
- CWE-918 Server-Side Request Forgery
Affected Products
| Product | Versions |
|---|---|
Zhiyuan OA Web Application SystemSeeyon |
|
References
- VDB-310221 | Seeyon Zhiyuan OA Web Application System ThirdMenuController.class this.oursNetService.getData server-side request forgeryvdb-entrytechnical-description
- VDB-310221 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
- Submit #574440 | Seeyon Zhiyuan OA Web Application System V8.1 SP2 Server-Side Request Forgery Vulnerabilitythird-party-advisory
- https://wx.mail.qq.com/s?k=i0-p-2N4MHcFOeM00Eexploit
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.