CVE-2021-47703

🗓️ 09 Dec 2025 20:36:20Reported by VulnCheckType

cve🔗 web.nvd.nist.gov👁 13 Views🌐 WEB

SSRF in OpenBMCS 2.4 via /php/query.php allows ip param to reach hosts and hijack sessions.

Reporter	Title	Published	Views	Family All 9
CNNVD	OpenBMCS 代码问题漏洞	9 Dec 202500:00	–	cnnvd
Cvelist	CVE-2021-47703 OpenBMCS Server Side Request Forgery (SSRF) via /php/query.php	9 Dec 202520:36	–	cvelist
EUVD	EUVD-2021-34736	9 Dec 202521:31	–	euvd
NVD	CVE-2021-47703	9 Dec 202521:15	–	nvd
OSV	CVE-2021-47703	9 Dec 202521:15	–	osv
Positive Technologies	PT-2025-50233	9 Dec 202500:00	–	ptsecurity
RedhatCVE	CVE-2021-47703	10 Dec 202521:16	–	redhatcve
Vulnrichment	CVE-2021-47703 OpenBMCS Server Side Request Forgery (SSRF) via /php/query.php	9 Dec 202520:36	–	vulnrichment
Zero Science Lab	OpenBMCS 2.4 Unauthenticated SSRF / RFI	16 Jan 202200:00	–	zeroscience

NVD

Vulners

Node

openbmcs openbmcsMatch2.4

[
  {
    "defaultStatus": "unaffected",
    "product": "OpenBMCS",
    "vendor": "OPEN BMCS",
    "versions": [
      {
        "status": "affected",
        "version": "2.4"
      }
    ]
  }
]

Source	Link
vulncheck	www.vulncheck.com/advisories/openbmcs-server-side-request-forgery-ssrf-via-phpqueryphp
openbmcs	www.openbmcs.com/
exploit-db	www.exploit-db.com/exploits/50670
zeroscience	www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5694.php

Parameter	Position	Path	Description	CWE
ip	request body	/php/query.php	Unauthenticated SSRF/RFI via POST parameter ip used to query external host, enabling arbitrary server requests	CWE-918
argu	request body	/php/query.php	Unauthenticated SSRF/RFI via POST parameter ip used to query external host, enabling arbitrary server requests	CWE-918

17 Jun 2026 04:18Current

6.7Medium risk

Vulners AI Score6.7

CVSS 3.17.2

CVSS 46.9

EPSS0.0027

SSVC

CWE-918