Seeyon Zhiyuan OA Web Application System Server-Side Request Forgery Vulnerability

A critical server-side request forgery (SSRF) vulnerability has been identified in Seeyon Zhiyuan OA Web Application System versions through 8.1 SP2. The issue arises in the ThirdMenuController.class file, specifically within the this.oursNetService.getData function. The vulnerability allows remote attackers to manipulate the url argument, potentially leading to unauthorized network requests that could target internal systems or external networks.

Impact

Exploitation of this vulnerability allows for server-side request forgery, where an attacker can send forged requests from the server to internal or external systems, potentially leading to further exploitation or information disclosure.