Chaining SSRF into session compromise
An unauthenticated SSRF and improper log neutralization in a-blog cms could be combined to hijack an administrative session.
The chain
The first issue allowed an unauthenticated attacker to make server-side requests through a-blog cms. A second weakness failed to neutralize attacker-controlled data written into logs. In combination, the two behaviors could cross another trust boundary and expose an administrator’s session.
The outcome
JPCERT/CC published the coordinated advisory and credits Vu Chi Thanh (vcth4nh) as the reporter. The issues were assigned CVE-2025-36560 and CVE-2025-41429.
The case is a useful reminder that individually scoped bugs can become materially more serious when they share data and trust assumptions.