A vulnerability has been found in Youke365 up to 1.5.3 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /app/api/controller/collect.php. The manipulation of the argument url leads to server-side request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249871.
References
Link | Resource |
---|---|
https://note.zhaoj.in/share/3jF3Xpl3ttlZ | Broken Link |
https://vuldb.com/?ctiid.249871 | Permissions Required Third Party Advisory |
https://vuldb.com/?id.249871 | Third Party Advisory |
Configurations
History
11 Jan 2024, 18:53
Type | Values Removed | Values Added |
---|---|---|
First Time |
Youke365 youke 365
Youke365 |
|
References | () https://note.zhaoj.in/share/3jF3Xpl3ttlZ - Broken Link | |
References | () https://vuldb.com/?id.249871 - Third Party Advisory | |
References | () https://vuldb.com/?ctiid.249871 - Permissions Required, Third Party Advisory | |
CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
CPE | cpe:2.3:a:youke365:youke_365:*:*:*:*:*:*:*:* |
08 Jan 2024, 08:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2024-01-08 08:15
Updated : 2024-05-17 02:34
NVD link : CVE-2024-0304
Mitre link : CVE-2024-0304
CVE.ORG link : CVE-2024-0304
JSON object : View
Products Affected
youke365
- youke_365
CWE
CWE-918
Server-Side Request Forgery (SSRF)