| 标题 | SourceCodester Website Link Extractor 1.0 (or Latest) Server-Side Request Forgery (SSRF) |
|---|
| 描述 | A Server-Side Request Forgery (SSRF) vulnerability exists in the Website Link Extractor application by SourceCodester.
The application accepts a user-supplied URL and retrieves its content using the PHP function file_get_contents() without proper validation, filtering, or network restrictions.
An attacker can supply crafted URLs to access internal resources and services. The application allows requests to internal addresses such as:
http://127.0.0.1
http://localhost
http://[email protected]
Impact:
The vulnerability allows an attacker to access internal services, perform internal network enumeration, and potentially retrieve sensitive information depending on the server environment.
The vulnerability may allow access to internal services such as 127.0.0.1, internal admin panels, or cloud metadata endpoints (e.g., AWS x.x.x.x).
Full technical details and screenshots are available in the public advisory.
|
|---|
| 来源 | ⚠️ https://medium.com/@hemantrajbhati5555/ssrf-vulnerability-in-sourcecodester-website-link-extractor-v1-0-5df6bb708f5e |
|---|
| 用户 | Hemant Raj Bhati (UID 95613) |
|---|
| 提交 | 2026-02-15 20時54分 (8 月前) |
|---|
| 管理 | 2026-02-24 22時54分 (9 days later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 347670 [SourceCodester Website Link Extractor 1.0 URL file_get_contents 权限提升] |
|---|
| 积分 | 20 |
|---|