CVE-2024-27564
pictureproxy.php in the dirk1983 mm1.ltd source code f9f4bbc allows SSRF via the url parameter. NOTE: the references section has an archived copy of...
- Published
- Mar 5, 2024
- Updated
- Mar 20, 2025
- Assigning CNA
- mitre
- Evidence observed
- Aug 8, 2026
Primary CVSS
nvd · CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:NModerate · next 30 days
- Percentile
- 98.6%
- Model date
- Sep 21, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
Summary
pictureproxy.php in the dirk1983 mm1.ltd source code f9f4bbc allows SSRF via the url parameter. NOTE: the references section has an archived copy of pictureproxy.php from its original GitHub location, but the repository name might later change because it is misleading.
Sources
2Proof-of-concept for CVE-2024-27564, an unauthenticated SSRF in pictureproxy.php via the url parameter, with vulnerable code, curl PoC, and mitigation notes.
Proof-of-concept exploit for CVE-2024-27564, demonstrating SSRF via unvalidated URL parameter in pictureproxy.php. Includes curl-based testing and FOFA search for vulnerable instances.
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.