Server side request forgery (ssrf)

2018-11-2822:29:00

PRIOn knowledge base

www.prio-n.com

6.4 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

28.6%

JSON

admin/functions/remote.php in Interspire Email Marketer through 6.1.6 has Server Side Request Forgery (SSRF) via a what=importurl&url= request with an http or https URL. This also allows reading local files with a file: URL.

CPENameOperatorVersion
email_marketerle6.1.6
email_marketereq6.1.8

CPE	Name	Operator	Version
	email_marketer	le	6.1.6
	email_marketer	eq	6.1.8

References

medium.com/@namhb/ssrf-to-lfi-in-interspire-email-marketer-698a748462a9