| Название | feelec-yishu feelcrm-os 1.0.0 Server-Side Request Forgery |
|---|
| Описание | FeelCRM 1.0.0 is affected by an unauthenticated blind server-side request forgery vulnerability in the `/index.php/Index/Google/getCurlData` endpoint. The attacker-controlled `url` GET parameter is passed directly to PHP cURL through `CURLOPT_URL` without scheme, host, port, or private-network destination validation. An unauthenticated attacker can submit a request such as `http://TARGET/index.php/Index/Google/getCurlData?url=http%3A%2F%2F127.0.0.1%3A8888` and cause the application server to connect to an internal HTTP service bound to `127.0.0.1:8888`. The supplied reproduction screenshot shows the internal service receiving the request. The vulnerable endpoint does not expose the target response body to the attacker, so this issue is classified as blind SSRF rather than response-reflecting SSRF. Depending on reachable internal services, the vulnerability may enable internal service discovery, request triggering, and access to privileged or state-changing internal endpoints. |
|---|
| Источник | ⚠️ https://github.com/feelec-yishu/feelcrm-os/issues/4 |
|---|
| Пользователь | liaoxijun10086 (UID 101151) |
|---|
| Представление | 14.09.2026 14:23 (21 дни назад) |
|---|
| Модерация | 05.10.2026 00:44 (20 days later) |
|---|
| Статус | принято |
|---|
| Запись VulDB | 413471 [feelec-yishu feelcrm-os 1.0.0 getCurlData Endpoint GoogleController.class.php url эскалация привилегий] |
|---|
| Баллы | 20 |
|---|