CVE-2025-9402 | HuangDou UTCMS 9 Config update.php UPDATEURL server-side request forgery

A vulnerability was found in HuangDou UTCMS 9. It has been rated as critical. This issue affects some unknown processing of the file app/modules/ut-frame/admin/update.php of the component Config Handler. Performing manipulation of the argument UPDATEURL results in server-side request forgery.

This vulnerability is reported as CVE-2025-9402. The attack is possible to be carried out remotely. Moreover, an exploit is present.

The vendor was contacted early about this disclosure but did not respond in any way.