A critical SSRF vulnerability in OTCMS allows unauthenticated attackers to probe internal network resources, posing a significant risk to internal infrastructure security.

The vulnerability exists in the AnnounContent function within the /admin/read.php endpoint. It allows an unauthenticated remote attacker to craft malicious HTTP requests that force the server to interact with arbitrary internal or external URLs.

Successful exploitation of this SSRF vulnerability permits attackers to bypass perimeter firewalls and interact with internal services that are not exposed to the public internet. With a CVSS score of 7.5, this high-severity flaw could lead to unauthorized information disclosure, such as accessing sensitive internal metadata, cloud instance credentials, or internal administrative interfaces, potentially resulting in full system compromise.

Immediate Action: Since no official patch is currently identified, users should restrict network access to the affected OTCMS installation and disable the vulnerable AnnounContent functionality if it is not business critical.

Proactive Monitoring: Monitor server access logs for unusual outbound requests originating from the web server to internal IP addresses or sensitive external domains.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict egress filtering rules to block unauthorized outbound requests from the web server to internal network ranges or non-essential external destinations.

Public Exploit Available: Yes, a public proof-of-concept exists, as documented in the research write-up linked by the CVE record.

Given the high CVSS score and the presence of a public proof-of-concept, organizations must treat this vulnerability with high priority. We recommend isolating the affected OTCMS instance from internal networks until a vendor-supplied patch is released and applied. Consistent monitoring of outbound traffic is essential to detect potential reconnaissance or lateral movement attempts by malicious actors.