EUVD-2026-92401
GHSA-j6f9-frhx-wfq4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach getCurlData endpoint remotely
-
DeliverySupply attacker-controlled 'url' argument
-
ExploitServer issues forged outbound request (SSRF)
-
ExecutionAccess internal/metadata resources
-
ImpactLimited data disclosure
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the vulnerable getCurlData endpoint in App/Feelcrm/Index/Controller/GoogleController.class.php be network-reachable and that the application pass the user-supplied 'url' argument into its server-side cURL request without validation/allowlisting. Per the CVSS vector (PR:N/UI:N) no authentication or user interaction is required against a default deployment of feelcrm-os 1.0.0. Limiting factors: the attacker must be able to reach the application's HTTP interface (not exposed if the CRM is internal-only), impact is constrained to LOW confidentiality/integrity/availability with no scope change, and actual damage depends on what internal services or metadata endpoints are reachable from the server. |
| Impact | The CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated SSRF, but the vendor-assigned score of 6.9 (Medium) is tempered by uniformly LOW technical impact (VC:L/VI:L/VA:L) and no scope change to subsequent systems (SC:N/SI:N/SA:N) - this is a limited-impact SSRF, not a full internal-pivot or credential-theft primitive as scored. The input provides no EPSS probability and no CISA KEV listing, so there is no evidence of active exploitation; the only exploitation signal is publicly available exploit code (VulDB-referenced GitHub issue), which indicates reachability but NOT real-world weaponization. The E:P (Proof-of-Concept) threat metric in the supplied 4.0 vector is consistent with that POC-only status. Net assessment: this is a genuine but low-priority issue - the obscurity of the affected product (feelec-yishu feelcrm-os 1.0.0) and the low impact ratings outweigh the unauthenticated network reachability. Note the product appears unmaintained: the description states the project was notified via an issue report but has not responded, so no patch is confirmed available. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends a crafted request to the getCurlData endpoint in GoogleController.class.php, supplying an attacker-controlled value in the 'url' argument so the server issues an outbound request to an internal or attacker-chosen host. This could be used to probe internal services, reach cloud metadata endpoints, or exfiltrate limited responses. Public exploit/POC details have been disclosed via the VulDB-linked GitHub issue, lowering the barrier to reproduction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 05, 2026
Server-side request forgery in feelec-yishu feelcrm-os 1.0.0 allows unauthenticated remote attackers to make the application's server issue attacker-controlled HTTP requests through the getCurlData endpoint in App/Feelcrm/Index/Controller/GoogleController.class.php, by manipulating the 'url' argument. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms this is remotely reachable, low-complexity and requires no authentication or user interaction, while impact is uniformly LOW (VC:L/VI:L/VA:L) with no scope change, making it a limited-impact SSRF rather than a full internal pivot or credential-theft primitive. Publicly available exploit code exists and the issue was reported to the project, which has not yet responded with a fix; no confirmed active exploitation (CISA KEV) has been observed.
RemediationAI
No vendor-released patch identified at time of analysis: the maintainers were notified through the public issue at https://github.com/feelec-yishu/feelcrm-os/issues/4 and https://vuldb.com/vuln/413471 but have not responded, so upgrading is not currently an option and compensating controls must carry the risk. The most effective immediate control is to block the vulnerable endpoint: if Google integration through getCurlData in App/Feelcrm/Index/Controller/GoogleController.class.php is not required, remove or disable that action at the web-server/router level (this may break Google API functionality that depends on it, and the restriction may be lost on redeployment or upgrade). Where the feature must stay, add strict server-side validation of the 'url' argument - allowlisting only expected Google API hostnames, requiring an https scheme, and rejecting any host that resolves to private, loopback, link-local, or cloud metadata address ranges (169.254.169.254, 127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, ::1) - noting that DNS-rebinding and redirect-based bypasses mean validation must be applied after resolution and with cURL redirect following disabled, which can break legitimate redirecting upstream endpoints. Enforce outbound egress filtering from the CRM host through an allowlisting proxy or firewall so only approved external destinations are reachable, and specifically deny access to instance metadata services; this is the strongest containment but requires network change control and can disrupt other outbound integrations. Finally, do not expose the CRM HTTP interface directly to the internet (place it behind VPN or an authenticating reverse proxy) and monitor logs for requests to GoogleController/getCurlData carrying unexpected 'url' values, accepting that this reduces rather than eliminates exposure for internal attackers.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerable component is a PHP web application (feelcrm-os, a CRM system) whose GoogleController class exposes a getCurlData action that builds a server-side cURL request from a caller-supplied 'url' parameter. Because the URL is passed into the cURL handler without validation, allowlisting, or blocking of private/link-local address ranges, the request is issued by the web server itself and the attacker can redirect it to internal-only services, loopback interfaces, or cloud instance metadata endpoints (e.g. 169.254.169.254). This is the classic CWE-918 Server-Side Request Forgery pattern: the trust boundary between the public HTTP request and the server's outbound network position is not enforced. The CVSS 4.0 vector shows exploitability at E:P (proof-of-concept published) with Network attack vector and no privileges or interaction required, but the assessed technical impact is constrained to LOW confidentiality, integrity and availability, and there is no scope change to subsequent systems (SC:N/SI:N/SA:N), so the practical damage ceiling depends on what the server can actually reach on the internal network. Note that the CPE entry (cpe:2.3:a:feelec-yishu:feelcrm-os:*:*) does not pin an exact version, so the affected version range is derived from the reported release 1.0.0.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Remote unauthenticated endpoint with attacker-controlled URL gives AV:N/AC:L/PR:N/UI:N; SSRF yields limited C/I/A:L and S:U as no confirmed cross-system scope break is documented.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was determined in feelec-yishu feelcrm-os 1.0.0. This affects an unknown part of the file App/Feelcrm/Index/Controller/GoogleController.class.php of the component getCurlData Endpoint. Executing a manipulation of the argument url can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB