| タイトル | diyhi bbs 6.8 Server-Side Request Forgery |
|---|
| 説明 | In the bbs project, the /admin/login POST endpoint constructs a request URL by concatenating user‑controlled HTTP request attributes—namely request.getScheme(), request.getServerName(), request.getServerPort() and request.getContextPath(). Because request.getServerName() is derived from the incoming Host header, an attacker can supply an arbitrary hostname (and port), causing the application to make backend HTTP requests to attacker‑controlled or otherwise unauthorized targets.
Project Link: https://github.com/diyhi/bbs
Affected Version: 6.8
Affected API: /admin/login
Code Location: /src/main/java/cms/web/action/AdminManageAction.java:213 |
|---|
| ソース | ⚠️ https://github.com/ShenxiuSec/cve-proofs/blob/main/POC-20250618-02.md |
|---|
| ユーザー | ShenxiuSecurity (UID 84374) |
|---|
| 送信 | 2025年06月18日 11:10 (1 年 ago) |
|---|
| モデレーション | 2025年06月27日 07:23 (9 days later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 314073 [diyhi bbs 迄 6.8 HTTP Header /admin/login getUrl Host 特権昇格] |
|---|
| ポイント | 20 |
|---|