CVE-2024-48234

An issue was discovered in mipjz 5.0.5. In the push method of app\tag\controller\ApiAdminTag.php the value of the postAddress parameter is not processed and is directly passed into curlexec execution and output, resulting in Server-side request forgery SSRF vulnerability that can read server file...

CVE-2024-48232

CVE-2024-48232 affects mipjz 5.0.5. The issue is in the mipPost method of \app\setting\controller\ApiAdminTool.php, where the postAddress parameter is not validated and is passed directly to curl_exec, enabling Server-Side Request Forgery (SSRF) that can read server files. Documented across NVD/R...