| शीर्षक | cdevroe unmark 1.9.3 Server-Side Request Forgery |
|---|
| विवरण | Unmark v1.9.3 suffers from an SSRF flaw in /application/controllers/Marks.php where the unsanitized “url” parameter fed to the POST /marks endpoint is fetched server-side by cURL without any whitelist, DNS rebinding or protocol checks, allowing attackers to force the backend to issue arbitrary HTTP/HTTPS requests to internal hosts, cloud metadata services or private APIs, thereby exposing sensitive data, bypassing network controls and enabling lateral movement—all while appearing to originate from the trusted server itself. |
|---|
| स्रोत | ⚠️ https://github.com/YZS17/CVE/blob/main/unmark/ssrf1.md |
|---|
| उपयोगकर्ता | XU-17 (UID 86055) |
|---|
| सबमिशन | 28/08/2025 08:46 PM (1 वर्ष पहले) |
|---|
| संयम | 12/09/2025 10:46 AM (15 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 323755 [cdevroe unmark तक 1.9.3 Marks.php url अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|