CVE-2024-25181
CriticalSummary
A critical vulnerability in givanz VvvebJs 1.7.2 allows both Server-Side Request Forgery (SSRF) and arbitrary file reading. It stems from improper handling of user-supplied URLs in the "file_get_contents" function within the "save.php" file.
Risk Assessment
An attacker can exploit SSRF to scan internal networks or read arbitrary files from the server, potentially leading to sensitive data leakage.
Recommendation
Update VvvebJs to the latest version or implement protections such as URL validation and restricting access to the file_get_contents function.
Original NVD description (English source)
A critical vulnerability has been identified in givanz VvvebJs 1.7.2, which allows both Server-Side Request Forgery (SSRF) and arbitrary file reading. The vulnerability stems from improper handling of user-supplied URLs in the "file_get_contents" function within the "save.php" file.