| शीर्षक | Zentao PMS <=21.7.6-85642 SSRF |
|---|
| विवरण | A Server-Side Request Forgery (SSRF) vulnerability exists in the Webhook module of ZenTao CMS that allows authenticated administrators to read arbitrary files from the server's local filesystem. The vulnerability stems from insufficient URL validation when configuring webhook URLs, specifically the lack of protocol filtering for the file:// scheme. Additionally, the response from file protocol requests is stored and displayed in the webhook logs, enabling attackers to retrieve sensitive file contents. |
|---|
| स्रोत | ⚠️ https://github.com/ez-lbz/ez-lbz.github.io/issues/9 |
|---|
| उपयोगकर्ता | ez-lbz (UID 87033) |
|---|
| सबमिशन | 20/01/2026 10:29 AM (9 महीनों पहले) |
|---|
| संयम | 04/02/2026 03:17 PM (15 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 344264 [ZenTao तक 21.7.6-85642 Webhook module/webhook/model.php fetchHook अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|