CVE-2025-14008: Xunruicms XunRuiCMS SSRF Vulnerability

CVE-2025-14008 Overview

CVE-2025-14008 is a Server-Side Request Forgery (SSRF) vulnerability affecting dayrui XunRuiCMS versions up to 4.7.1. The flaw resides in the admin79f2ec220c7e.php?c=api&m=test_site_domain endpoint, part of the Project Domain Change Test component. Attackers manipulate the v argument to coerce the server into issuing arbitrary outbound requests. The exploit has been publicly disclosed, and the vendor did not respond to coordinated disclosure attempts. The vulnerability is tracked under CWE-918.

Critical Impact
Authenticated attackers can abuse the test_site_domain handler to make the XunRuiCMS server issue requests to internal or external resources, enabling reconnaissance against internal networks and interaction with internal services.

Affected Products

dayrui XunRuiCMS versions up to and including 4.7.1
Component: Project Domain Change Test (admin79f2ec220c7e.php?c=api&m=test_site_domain)
Vulnerable parameter: v

Discovery Timeline

2025-12-04 - CVE-2025-14008 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-14008

Vulnerability Analysis

The vulnerability exists in the administrative API handler admin79f2ec220c7e.php when invoked with c=api&m=test_site_domain. The endpoint accepts a user-controlled v parameter intended to test a configured site domain. The application does not validate or restrict the destination of the request derived from this parameter. As a result, the server fetches arbitrary URLs supplied by the attacker.

The issue is classified as [CWE-918] Server-Side Request Forgery. Exploitation requires high privileges on the application, since the affected handler resides under the admin interface. EPSS data indicates a probability of 0.346% at the 26.4 percentile.

Root Cause

The test_site_domain function consumes the v parameter without enforcing an allowlist of permitted hosts or schemes. The handler trusts admin-supplied input and forwards it directly to a request-issuing routine. No filtering blocks internal IP ranges, loopback addresses, or non-HTTP protocols.

Attack Vector

An authenticated administrative user submits a crafted request to the test_site_domain endpoint with the v parameter pointing to an internal host or service. The XunRuiCMS server then issues an HTTP request to the supplied target. Attackers use this primitive to probe internal infrastructure, reach metadata services, or interact with services not exposed externally.

The vulnerability mechanism is documented in the publicly available GitHub SSRF Test Case and the VulDB entry #334250. No verified exploit code is reproduced here.

Detection Methods for CVE-2025-14008

Indicators of Compromise

HTTP requests to admin79f2ec220c7e.php containing the parameters c=api, m=test_site_domain, and a v value pointing to internal IP ranges (RFC1918), 127.0.0.1, or cloud metadata endpoints such as 169.254.169.254.
Outbound connections from the XunRuiCMS application server to unexpected internal hosts or non-standard ports immediately following admin API calls.
Web server access logs showing repeated test_site_domain invocations with varying v parameter values.

Detection Strategies

Inspect web server logs for the admin79f2ec220c7e.php?c=api&m=test_site_domain URI pattern and correlate with the source IP, session, and parameter contents.
Deploy WAF rules that flag or block v parameter values resolving to private address space, link-local addresses, or non-HTTP schemes.
Monitor egress traffic from the CMS host and alert when destinations fall outside an expected allowlist of external services.

Monitoring Recommendations

Enable verbose logging on the XunRuiCMS admin interface and forward logs to a centralized SIEM for retention and correlation.
Track administrator session activity to detect unusual access patterns or compromised credentials being used against the vulnerable endpoint.
Baseline normal outbound traffic from the CMS host so SSRF-driven anomalies stand out against expected behavior.

How to Mitigate CVE-2025-14008

Immediate Actions Required

Restrict network access to the XunRuiCMS administrative interface to trusted management networks only.
Rotate administrative credentials and audit existing admin accounts for unauthorized access.
Apply egress filtering on the CMS host to block outbound traffic to internal subnets, loopback addresses, and cloud metadata endpoints.

Patch Information

No vendor patch is available at the time of publication. According to the CVE record, the vendor was contacted prior to disclosure but did not respond. Monitor the XunRuiCMS project page and the VulDB entry #334250 for updates.

Workarounds

Block or rewrite requests to admin79f2ec220c7e.php?c=api&m=test_site_domain at the reverse proxy or WAF layer until a fix is released.
Configure the application server to deny outbound HTTP requests to private IP ranges, 127.0.0.0/8, and 169.254.0.0/16 using firewall rules or proxy policy.
Place the CMS behind an authenticated reverse proxy and require multi-factor authentication for any access to admin endpoints.

bash

# Example nginx rule to block the vulnerable endpoint
location ~* /admin79f2ec220c7e\.php {
    if ($arg_m = "test_site_domain") {
        return 403;
    }
}