CVE-2025-10765 Overview
CVE-2025-10765 is a Server-Side Request Forgery (SSRF) vulnerability affecting SeriaWei ZKEACMS versions up to 4.3. The flaw resides in the CheckPage/Suggestions function within the cms-v4.3\wwwroot\Plugins\ZKEACMS.SEOSuggestions\ZKEACMS.SEOSuggestions.dll library of the SEOSuggestions component. Authenticated attackers with high privileges can manipulate request parameters to coerce the server into making arbitrary outbound HTTP requests. The exploit code has been disclosed publicly. The vendor was contacted prior to disclosure but did not respond.
Critical Impact
Authenticated attackers can abuse the SEOSuggestions endpoint to issue server-side requests to internal or external systems, enabling reconnaissance of internal networks and potential interaction with non-public services [CWE-918].
Affected Products
- SeriaWei ZKEACMS versions up to and including 4.3
- ZKEACMS SEOSuggestions plugin (ZKEACMS.SEOSuggestions.dll)
- Deployments exposing the CheckPage/Suggestions endpoint to remote users
Discovery Timeline
- 2025-09-21 - CVE-2025-10765 published to NVD
- 2026-04-29 - Last updated in NVD database
Technical Details for CVE-2025-10765
Vulnerability Analysis
The vulnerability is classified as Server-Side Request Forgery [CWE-918]. The CheckPage/Suggestions function inside the SEOSuggestions plugin accepts a target URL parameter that the server fetches as part of its SEO analysis workflow. The function does not adequately validate or restrict the destination, allowing attackers to substitute arbitrary URLs. Successful exploitation lets the ZKEACMS server initiate HTTP requests on behalf of the attacker. The CVE record indicates the exploit has been released publicly, and the EPSS probability remains low, reflecting limited observed targeting.
Root Cause
The root cause is missing destination validation in the SEO suggestion routine. The handler treats user-supplied URLs as trusted input and dispatches outbound requests without restricting the scheme, host, or address range. Internal IP space, link-local addresses, and metadata endpoints are not blocked.
Attack Vector
The attack is remote and requires authentication. An attacker with valid high-privilege credentials submits a crafted request to the CheckPage/Suggestions endpoint, supplying a target URL pointing to an internal service, cloud metadata endpoint, or arbitrary external host. The ZKEACMS application server then performs the request, and response content or timing differences expose information about reachable internal assets. See the GitHub Issue Report and VulDB entry #325120 for additional technical context.
No verified proof-of-concept code is included in the NVD record. Refer to the linked VulDB and GitHub references for exploitation details rather than synthetic examples.
Detection Methods for CVE-2025-10765
Indicators of Compromise
- Unexpected outbound HTTP requests originating from the ZKEACMS application server to internal RFC1918 addresses, link-local ranges (169.254.0.0/16), or cloud metadata services.
- Web server access logs containing requests to /CheckPage/Suggestions with url parameters referencing non-public hosts or unusual schemes.
- Authenticated session activity from administrative accounts followed by anomalous server-initiated traffic.
Detection Strategies
- Inspect IIS or reverse-proxy logs for CheckPage/Suggestions requests and correlate them with downstream connections from the ZKEACMS host.
- Deploy egress filtering and alert when the application server initiates connections outside its expected fetch destinations.
- Hunt for HTTP responses with sizes or status codes inconsistent with normal SEO scans, which can indicate probing of internal endpoints.
Monitoring Recommendations
- Forward web application and host network telemetry to a centralized analytics platform for correlation of inbound CheckPage/Suggestions calls with outbound connection attempts.
- Baseline the application server's normal outbound traffic and alert on deviations such as connections to cloud metadata IPs (169.254.169.254) or private CIDR ranges.
- Track repeated 4xx or 5xx responses from the SEOSuggestions endpoint, which may indicate enumeration attempts.
How to Mitigate CVE-2025-10765
Immediate Actions Required
- Restrict access to the ZKEACMS administrative interface and the SEOSuggestions plugin to trusted networks using firewall or reverse-proxy rules.
- Rotate credentials for high-privilege ZKEACMS accounts and audit administrative session activity for misuse.
- Disable the SEOSuggestions plugin in environments that do not require it until a vendor patch is available.
Patch Information
No vendor patch is referenced in the CVE record at the time of publication. The vendor did not respond to disclosure attempts. Monitor the ZKEACMS GitHub project and VulDB advisory #325120 for updates.
Workarounds
- Block egress traffic from the ZKEACMS server to internal management networks, cloud metadata endpoints, and any destination not explicitly required for operation.
- Place the application behind a reverse proxy that enforces an allowlist of outbound URLs for the SEOSuggestions feature.
- Remove or rename ZKEACMS.SEOSuggestions.dll in the plugins directory to disable the vulnerable code path until a fix is published.
# Example egress restriction using iptables to block access to common SSRF targets
iptables -A OUTPUT -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -d 192.168.0.0/16 -j REJECT
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
