CVE-2018-19601

Name of the Vulnerable Software and Affected Versions Rhymix CMS version 1.9.8.1

Description The issue allows for Server-Side Request Forgery (SSRF) via an SVG upload in the admin module. This can be achieved by accessing the "index.php?module=admin&act=dispModuleAdminFileBox" endpoint with a malicious SVG file.

Recommendations For Rhymix CMS version 1.9.8.1, as a temporary workaround, consider disabling the SVG upload feature in the admin module until a patch is available. Restrict access to the "index.php?module=admin&act=dispModuleAdminFileBox" endpoint to minimize the risk of exploitation.