A vulnerability was found in yanyutao0402 ChanCMS up to 3.1.2. It has been classified as problematic. Affected is an unknown function of the file /sysApp/find. The manipulation of the argument accessKey/secretKey leads to information disclosure. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.1.3 is able to address this issue. It is recommended to upgrade the affected component.
References
| Link | Resource |
|---|---|
| https://gitee.com/yanyutao0402/ChanCMS/issues/ICLP9V | Exploit |
| https://vuldb.com/?ctiid.317814 | Permissions Required VDB Entry |
| https://vuldb.com/?id.317814 | Third Party Advisory VDB Entry |
| https://vuldb.com/?submit.622167 | Third Party Advisory VDB Entry |
Configurations
History
01 Aug 2025, 17:41
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://vuldb.com/?id.317814 - Third Party Advisory, VDB Entry | |
| References | () https://gitee.com/yanyutao0402/ChanCMS/issues/ICLP9V - Exploit | |
| References | () https://vuldb.com/?ctiid.317814 - Permissions Required, VDB Entry | |
| References | () https://vuldb.com/?submit.622167 - Third Party Advisory, VDB Entry | |
| First Time |
Yanyutao0402
Yanyutao0402 chancms |
|
| CWE | NVD-CWE-noinfo | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
| CPE | cpe:2.3:a:yanyutao0402:chancms:*:*:*:*:*:*:*:* |
27 Jul 2025, 09:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-07-27 09:15
Updated : 2025-08-01 17:41
NVD link : CVE-2025-8226
Mitre link : CVE-2025-8226
JSON object : View
Products Affected
yanyutao0402
- chancms
CWE
CWE-200
Exposure of Sensitive Information to an Unauthorized Actor
NVD-CWE-noinfo CWE-284Improper Access Control