Rhaphp
Monthly
Server-side request forgery in the RhaPHP Mp Module media proxy lets unauthenticated remote attackers make the server issue requests to arbitrary URLs by manipulating the 'url' argument handled in application/mp/controller/Show.php. The flaw affects the rolling-release RhaPHP codebase up to commit 7ae639ccf8dcb627faace096d030bd4cb4cfb905; because the project does not publish numbered versions, no affected or fixed release versions are available. A public PoC reference exists but is not verified as working exploit code, and the measured impact is low across confidentiality, integrity and availability.
Server-side request forgery in the RhaPHP Mp Module media proxy lets unauthenticated remote attackers make the server issue requests to arbitrary URLs by manipulating the 'url' argument handled in application/mp/controller/Show.php. The flaw affects the rolling-release RhaPHP codebase up to commit 7ae639ccf8dcb627faace096d030bd4cb4cfb905; because the project does not publish numbered versions, no affected or fixed release versions are available. A public PoC reference exists but is not verified as working exploit code, and the measured impact is low across confidentiality, integrity and availability.