| शीर्षक | Tangram wisi Control GT31 Server-Side Request Forgery |
|---|
| विवरण | It is possible to induce the application to retrieve the contents of an arbitrary external URL and return those contents in its own response. The payload http://zps398f6qv5y11m4bpcz2bo05rbizanz.oastify.com/ was submitted in the HTTP Request-Line. The application performed an HTTP request to the specified domain. The response from that request was then included in the application's own response.
During the exploitation, it was identified that by replacing the request content from GET / to GET http://zps398f6qv5y11m4bpcz2bo05rbizanz.oastify.com/, DNS resolution and interaction with the collaborator occurred, indicating the possibility of a blind SSRF with out-of-band detection |
|---|
| स्रोत | ⚠️ http://x.x.x.x/data.xmlc?size=1 |
|---|
| उपयोगकर्ता | Havook (UID 71104) |
|---|
| सबमिशन | 14/12/2024 11:46 PM (2 साल पहले) |
|---|
| संयम | 27/12/2024 09:41 AM (12 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 289382 [WISI Tangram GT31 तक 20241214 HTTP Request अधिकार वृद्धि] |
|---|
| अंक | 17 |
|---|