| शीर्षक | Inis Inis ≤v2.0.1 SSRF |
|---|
| विवरण | The Inis Blog System, specifically in the file `app/api/controller/default/Proxy.php` of versions up to and including 2.0.1, contains a Server-Side Request Forgery (SSRF) vulnerability. This vulnerability is triggered by unsanitized user input through the `p_url` parameter, which allows an attacker to make arbitrary requests from the server hosting the Inis application. By crafting a malicious request, such as one using the `gopher` protocol, an attacker can force the application to interact with unintended internal or external services, potentially leading to information disclosure or other malicious activities. This issue was identified by the security researcher glzjin. |
|---|
| स्रोत | ⚠️ https://note.zhaoj.in/share/2E2JG2PClHGF |
|---|
| उपयोगकर्ता | glzjin (UID 59815) |
|---|
| सबमिशन | 05/01/2024 07:59 AM (3 साल पहले) |
|---|
| संयम | 07/01/2024 09:11 PM (3 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 249875 [Inis तक 2.0.1 Proxy.php p_url अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|