| शीर्षक | light0011 cms f72cf46f601efb2a0618c3814cc2f61380b38930 Server-Side Request Forgery |
|---|
| विवरण | The independently reachable `Public/ueditor/php/controller.php:15-45` dispatches the `catchimage` action without application authentication. `Public/ueditor/php/action_crawler.php:22-28` supplies attacker-controlled `source[]` URLs to `Uploader` in `remote` mode. `Public/ueditor/php/Uploader.class.php:182-210` only checks that a URL begins with `http`, then calls `get_headers()` and `readfile()` on it without hostname, IP-address, DNS, redirect, or allowlist controls. Lines 218-242 and 312-321 save the response below the web root. The endpoint therefore permits an unauthenticated attacker to request internal HTTP services and retrieve eligible response bodies through the generated public upload URL. The configured `catcherLocalDomain` value in `config.json` is not enforced.
|
|---|
| स्रोत | ⚠️ https://github.com/light0011/cms/issues/6 |
|---|
| उपयोगकर्ता | huihuo (UID 99926) |
|---|
| सबमिशन | 18/07/2026 07:53 AM (2 महीनों पहले) |
|---|
| संयम | 03/09/2026 07:54 PM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 398534 [light0011 cms UEditor controller.php catchimage source[] अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|