CVE-2024-36675 PoC — LyLme Spage 安全漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-36675.yaml

Associated Vulnerability

Title:LyLme Spage 安全漏洞 (CVE-2024-36675)
Description:LyLme Spage（六零导航页）是中国六零（LyLme）开源的一个导航页面。致力于简洁高效无广告的上网导航和搜索入口，支持后台添加链接、自定义搜索引擎，沉淀最具价值链接，全站无商业推广，简约而不简单。 LyLme Spage v1.9.5 版本存在安全漏洞，该漏洞源于 get_head 函数存在服务器端请求伪造 (SSRF) 漏洞。

Description

LyLme spage v1.9.5 is vulnerable to server-side request forgery (SSRF) via the url parameter in apply/index.php. An attacker can force the server to make arbitrary requests, potentially accessing internal resources.

File Snapshot


 id: CVE-2024-36675

info:
  name: LyLme spage v1.9.5 - Server-Side Request Forgery
  author: ritikch

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!