| शीर्षक | Youke365 Youke365 ≤v1.5.3 SSRF |
|---|
| विवरण | The Youke365 software, in versions up to and including 1.5.3, contains a blind Server-Side Request Forgery (SSRF) vulnerability within the /app/api/controller/caiji.php file. This vulnerability allows an attacker to manipulate the url parameter to send data to or make requests to the internal network. The issue arises because the input url parameter is directly used in constructing cURL requests without proper sanitization, particularly when using the gopher protocol, which can facilitate communication with the attacker's server, demonstrating the potential for unauthorized access to the internal system from an external network. |
|---|
| स्रोत | ⚠️ https://note.zhaoj.in/share/fssH60eQkvSl |
|---|
| उपयोगकर्ता | glzjin (UID 59815) |
|---|
| सबमिशन | 05/01/2024 03:20 AM (3 साल पहले) |
|---|
| संयम | 07/01/2024 09:00 PM (3 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 249870 [Youke365 तक 1.5.3 Parameter caiji.php url अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|