| タイトル | feelec-yishu feelcrm-os 1.0.0 Server-Side Request Forgery |
|---|
| 説明 | FeelCRM 1.0.0 is affected by an unauthenticated blind server-side request forgery vulnerability in the `/index.php/Index/Google/getCurlData` endpoint. The attacker-controlled `url` GET parameter is passed directly to PHP cURL through `CURLOPT_URL` without scheme, host, port, or private-network destination validation. An unauthenticated attacker can submit a request such as `http://TARGET/index.php/Index/Google/getCurlData?url=http%3A%2F%2F127.0.0.1%3A8888` and cause the application server to connect to an internal HTTP service bound to `127.0.0.1:8888`. The supplied reproduction screenshot shows the internal service receiving the request. The vulnerable endpoint does not expose the target response body to the attacker, so this issue is classified as blind SSRF rather than response-reflecting SSRF. Depending on reachable internal services, the vulnerability may enable internal service discovery, request triggering, and access to privileged or state-changing internal endpoints. |
|---|
| ソース | ⚠️ https://github.com/feelec-yishu/feelcrm-os/issues/4 |
|---|
| ユーザー | liaoxijun10086 (UID 101151) |
|---|
| 送信 | 2026年09月14日 14:23 (21 日 ago) |
|---|
| モデレーション | 2026年10月05日 00:44 (20 days later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 413471 [feelec-yishu feelcrm-os 1.0.0 getCurlData Endpoint GoogleController.class.php url 特権昇格] |
|---|
| ポイント | 20 |
|---|