Technical impact
The vulnerability is a server‑side request forgery that allows an attacker to make the application send arbitrary HTTP requests from the server side. By exploiting this flaw, malicious parties can reach internal network resources, read sensitive data, or use the infected server as a pivot point for further attacks. The impact therefore spans confidentiality and potential availability threats if internal services are abused.
Affected Systems
Yordam Informatics Technology Consulting, Training, and Electronic Systems Industry and Trade Inc. provides the Library Information and Document Automation Program. Versions before 22.2 contain the defect; newer releases are not affected.
Risk and Exploitability
The CVSS score of 5.3 indicates a moderate severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires remote access to the web application; if authentication is necessary, an attacker would need valid credentials or exploit an authentication bypass. Inferring from the description, an attacker could trigger internal requests without additional privileges, but the exact prerequisites are not detailed in the input.
