A critical server-side request forgery vulnerability in FeehiCMS allows remote, unauthenticated attackers to potentially bypass network controls and perform unauthorized requests.

This vulnerability is a server-side request forgery (CWE-918) occurring in the frontend/web/timthumb.php file. An unauthenticated remote attacker can trigger this flaw by manipulating the src argument to force the server to initiate unintended network requests.

The ability for an unauthenticated attacker to perform SSRF poses a significant risk to internal network security. By leveraging the server as a proxy, an attacker may be able to scan internal infrastructure, access sensitive metadata services, or interact with non-public internal applications, potentially leading to unauthorized data access or further exploitation. While the CVSS score of 7.3 indicates a high severity, the risk is compounded by the lack of vendor responsiveness and the publicly available nature of the exploit.

Immediate Action: As there is no official patch available from the vendor, administrators should immediately restrict access to the frontend/web/timthumb.php endpoint or disable the TimThumb component if it is not required for site functionality.

Proactive Monitoring: Review web server access logs for anomalous requests to the timthumb.php file, particularly those containing suspicious URLs or internal IP addresses in the src parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to inspect and block requests to the timthumb.php script that contain unexpected or external URLs within the src argument.

Public Exploit Available: Yes, a public proof-of-concept exists as referenced in the VulDB report (ID 338663).

Given the vendor's failure to provide a security update, users of FeehiCMS 2.1.0 and 2.1.1 must treat this vulnerability with extreme urgency. Immediate implementation of network-level or application-level mitigations is required to prevent unauthorized server-side requests until a formal patch is released or the component is removed from the environment.