上海灵当信息技术 灵当CRM index_event.php 服务器端请求伪造漏洞

该 SSRF 漏洞允许攻击者利用 crm/WeiXinApp/dingtalk/index_event.php 文件中的 corpurl 参数，向内部网络发起请求。攻击者可以利用此漏洞访问内部服务，读取敏感数据，甚至可能执行恶意代码。由于该漏洞已公开利用方案，攻击者可以轻松地利用此漏洞进行攻击。攻击的潜在影响包括内部网络扫描、敏感数据泄露、以及对内部系统的进一步攻击。攻击者可能利用此漏洞访问数据库服务器、文件服务器或其他内部资源，从而扩大攻击范围。

Organizations utilizing Lingdang CRM in environments with internal services accessible via HTTP are at significant risk. Specifically, deployments with weak network segmentation or those relying on the CRM for integration with internal systems are particularly vulnerable. Shared hosting environments where multiple customers share the same CRM instance are also at increased risk, as a compromise of one customer's account could potentially lead to SSRF attacks targeting other customers.

• php: Examine web server access logs for requests originating from the CRM server to unusual or internal IP addresses.

grep '127.0.0.1' /var/log/apache2/access.log | grep 'crm/WeiXinApp/dingtalk/index_event.php'

• php: Search for the crm/WeiXinApp/dingtalk/index_event.php file and review its code for the handling of the corpurl parameter. Look for missing or inadequate validation. • generic web: Use curl to test the vulnerability by sending a request with a malicious corpurl parameter and observing the server's response.

curl 'http://your-crm-server/crm/WeiXinApp/dingtalk/index_event.php?corpurl=http://internal-service/'

1. 2025-09-09Disclosure

   disclosure

2. 2025-09-09PoC

   poc

1. 已保留2025-05-20
2. 发布日期2025-09-09
3. EPSS 更新日期2026-03-23

为了缓解 CVE-2025-5005 带来的风险，首要措施是立即升级 Lingdang CRM 至 8.6.6 版本或更高版本。如果无法立即升级，可以考虑以下临时缓解措施：在 Web 应用防火墙（WAF）中配置规则，阻止对 crm/WeiXinApp/dingtalk/index_event.php 文件的恶意请求。限制 corpurl 参数的输入长度和允许的协议类型。实施严格的访问控制策略，限制内部服务的访问权限。在服务器上启用安全审计日志，以便检测和响应潜在的攻击。