| عنوان | diyhi bbs 6.8 Server-Side Request Forgery |
|---|
| الوصف | In the bbs project, the /admin/login POST endpoint constructs a request URL by concatenating user‑controlled HTTP request attributes—namely request.getScheme(), request.getServerName(), request.getServerPort() and request.getContextPath(). Because request.getServerName() is derived from the incoming Host header, an attacker can supply an arbitrary hostname (and port), causing the application to make backend HTTP requests to attacker‑controlled or otherwise unauthorized targets.
Project Link: https://github.com/diyhi/bbs
Affected Version: 6.8
Affected API: /admin/login
Code Location: /src/main/java/cms/web/action/AdminManageAction.java:213 |
|---|
| المصدر | ⚠️ https://github.com/ShenxiuSec/cve-proofs/blob/main/POC-20250618-02.md |
|---|
| المستخدم | ShenxiuSecurity (UID 84374) |
|---|
| ارسال | 18/06/2025 11:10 AM (1 سنة منذ) |
|---|
| الاعتدال | 27/06/2025 07:23 AM (9 days later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 314073 [diyhi bbs حتى 6.8 HTTP Header /admin/login getUrl Host تجاوز الصلاحيات] |
|---|
| النقاط | 20 |
|---|