| Title | feelec-yishu feelcrm-os 1.0.0 Server-Side Request Forgery |
|---|
| Description | FeelCRM 1.0.0 is affected by an unauthenticated blind server-side request forgery vulnerability in the `/index.php/Index/Google/getCurlData` endpoint. The attacker-controlled `url` GET parameter is passed directly to PHP cURL through `CURLOPT_URL` without scheme, host, port, or private-network destination validation. An unauthenticated attacker can submit a request such as `http://TARGET/index.php/Index/Google/getCurlData?url=http%3A%2F%2F127.0.0.1%3A8888` and cause the application server to connect to an internal HTTP service bound to `127.0.0.1:8888`. The supplied reproduction screenshot shows the internal service receiving the request. The vulnerable endpoint does not expose the target response body to the attacker, so this issue is classified as blind SSRF rather than response-reflecting SSRF. Depending on reachable internal services, the vulnerability may enable internal service discovery, request triggering, and access to privileged or state-changing internal endpoints. |
|---|
| Source | ⚠️ https://github.com/feelec-yishu/feelcrm-os/issues/4 |
|---|
| User | liaoxijun10086 (UID 101151) |
|---|
| Submission | 09/14/2026 14:23 (20 days ago) |
|---|
| Moderation | 10/05/2026 00:44 (20 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 413471 [feelec-yishu feelcrm-os 1.0.0 getCurlData Endpoint GoogleController.class.php url server-side request forgery] |
|---|
| Points | 20 |
|---|