CVE-2024-27564
MEDIUM EXPLOITED NUCLEIChatGPT个人专用版 - Server Side Request Forgery
Title source: nucleiExploitation Summary
CVE-2024-27564 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 3 public exploits from researchers including chsxthwik, chaudhrymuhammadtayab. A Nuclei detection template is also available.
AI-analyzed exploit summary This PoC demonstrates an SSRF vulnerability in `pictureproxy.php` where the `url` parameter is passed directly to `file_get_contents()` without validation, allowing arbitrary requests. The provided curl command exploits this to read local files.
Description
pictureproxy.php in the dirk1983 mm1.ltd source code f9f4bbc allows SSRF via the url parameter. NOTE: the references section has an archived copy of pictureproxy.php from its original GitHub location, but the repository name might later change because it is misleading.
Exploits (3)
This PoC demonstrates an SSRF vulnerability in `pictureproxy.php` where the `url` parameter is passed directly to `file_get_contents()` without validation, allowing arbitrary requests. The provided curl command exploits this to read local files.
This repository provides a writeup and proof-of-concept for CVE-2024-27564, an SSRF vulnerability in `pictureproxy.php` due to improper validation of the `url` parameter. The PoC demonstrates how an attacker can exploit this to perform arbitrary requests, including local file reads.
This repository contains a technical analysis of the Deadbolt ransomware, focusing on its SHA-256 implementation and lock screen changes. It includes JavaScript code snippets and diffs but does not provide a functional exploit.
Nuclei Templates (1)
title="ChatGPT个人专用版"
References (5)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N