Server-Side Request Forgery in iDocView by iDocView Solutions
CVE-2023-54402

8.7HIGH

Key Information:

Vendor

Idocview

Status
Idocview
Vendor
CVE Published:
30 September 2026

What is CVE-2023-54402?

iDocView is susceptible to a server-side request forgery vulnerability, specifically within its /doc/upload endpoint. This flaw allows remote, unauthenticated attackers to exploit a hardcoded default token ('testtoken') to bypass authentication mechanisms. Attackers can leverage this vulnerability to access arbitrary URLs, including local files and internal services, thus posing significant security risks. The ability to execute unrestricted URL scheme handling means that sensitive operating system and application configuration files can be exposed, compromising the integrity of the system.

Affected Version(s)

iDocView *

References

https://github.com/projectdiscovery/nuclei-templates/blob...
technical-description
https://blog.csdn.net/qq_41904294/article/details/134995343
exploit
https://www.vulncheck.com/advisories/idocview-ssrf-via-do...
third-party-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

The Shadowserver Foundation
.