Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Shanghai Lingdang Information Technology Lingdang CRM index_event.php server-side request forgery
Vulnerability Description
A vulnerability was detected in Shanghai Lingdang Information Technology Lingdang CRM up to 8.6.5.4. This affects an unknown function of the file crm/WeiXinApp/dingtalk/index_event.php. The manipulation of the argument corpurl results in server-side request forgery. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Vulnerability Type
服务端请求伪造(SSRF)
Vulnerability Title
Lingdang CRM 安全漏洞
Vulnerability Description
Lingdang CRM（灵当CRM）是中国灵当（Lingdang）公司的一个客户关系管理系统。 Lingdang CRM 8.6.5.4及之前版本存在安全漏洞，该漏洞源于对文件crm/WeiXinApp/dingtalk/index_event.php中参数corpurl的错误操作导致服务端请求伪造。
CVSS Information
N/A
Vulnerability Type
N/A