← Vulnerability feed

Vulnerability record · CVE-2022-38931 · published 20 September 2022

CVE-2022-38931: Baijiacms project baijiacms server-side request forgery (ssrf) vulnerability

BBaijiacms Project · Baijiacms

A Server-Side Request Forgery (SSRF) in fetch_net_file_upload function of baijiacmsV4 v4.1.4 allows remote attackers to force the application to make arbitrary requests via injection of arbitrary URLs into the url parameter.

8.8 CVSS 3.1 High EPSS 1.3% · top 30.8% CWE-918 · Server-side request forgery (SSRF)
8.8CVSS 3.1 base score
1.3%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

A Server-Side Request Forgery (SSRF) in fetch_net_file_upload function of baijiacmsV4 v4.1.4 allows remote attackers to force the application to make arbitrary requests via injection of arbitrary URLs into the url parameter.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/zer0yu/CVE_Request/blob/master/baijiacms/baijiacmsv4_ssrf.md ExploitThird Party Advisory
https://github.com/zer0yu/CVE_Request/blob/master/baijiacms/baijiacmsv4_ssrf.md ExploitThird Party Advisory

Track CVE-2022-38931 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2022-35150Baijiacms project baijiacms unrestricted file upload vulnerabilityBaijicms v4 was discovered to contain an arbitrary file upload vulnerability.EPSS 1.2%9.8CVE-2019-7568Baijiacms project baijiacms sql injection vulnerabilityAn issue was discovered in baijiacms V4 that can result in time-based blind SQL injection to get data via the cate parameter in an index.php?act=inde…EPSS 1.5%9.8CVE-2018-16724Baijiacms project baijiacms sql injection vulnerabilityAn issue is discovered in baijiacms V4. Blind SQL Injection exists via the order parameter in an index.php?act=index request.EPSS 1.2%8.8CVE-2022-45942Baijiacms project baijiacms os command injection vulnerabilityA Remote Code Execution (RCE) vulnerability was found in includes/baijiacms/common.inc.php in baijiacms v4.EPSS 22%8.8CVE-2018-10503Baijiacms project baijiacms cross-site request forgery vulnerabilityAn issue was discovered in index.php in baijiacms V4 v4_1_4_20170105. CSRF allows adding an administrator account via op=edituser, changing the admin…EPSS 0.51%8.8CVE-2018-10249Baijiacms project baijiacms cross-site request forgery vulnerabilitybaijiacms V3 has CSRF via index.php?mod=site&op=edituser&name=manager&do=user to add an administrator account.EPSS 0.50%6.5CVE-2021-33396Baijiacms project baijiacms cross-site request forgery vulnerabilityCross Site Request Forgery (CSRF) vulnerability in baijiacms 4.1.4, allows attackers to change the password or other information of an arbitrary acco…EPSS 0.32%6.5CVE-2020-25873Baijiacms project baijiacms path traversal vulnerabilityA directory traversal vulnerability in the component system/manager/class/web/database.php was discovered in Baijiacms V4 which allows attackers to a…EPSS 1.2%

Source: NIST National Vulnerability Database (record CVE-2022-38931), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.