Research archive
2025Independent researchViettel Cyber Security
SSRFLog injectionSession security

Chaining SSRF into session compromise

An unauthenticated SSRF and improper log neutralization in a-blog cms could be combined to hijack an administrative session.

The chain

The first issue allowed an unauthenticated attacker to make server-side requests through a-blog cms. A second weakness failed to neutralize attacker-controlled data written into logs. In combination, the two behaviors could cross another trust boundary and expose an administrator’s session.

The outcome

JPCERT/CC published the coordinated advisory and credits Vu Chi Thanh (vcth4nh) as the reporter. The issues were assigned CVE-2025-36560 and CVE-2025-41429.

The case is a useful reminder that individually scoped bugs can become materially more serious when they share data and trust assumptions.