This vulnerability in kalcaddle kodbox (up to version 1.64) involves server-side request forgery via manipulation of the siteFrom/siteTo parameters in the shareMake/shareCheck component. An attacker can remotely trigger the SSRF condition, potentially causing the server to make unintended requests. The attack complexity is high, and no privileges or user interaction are required. The vendor has not issued a fix or advisory, and no patch links are available. The CVSS 4.0 vector indicates network attack vector, high complexity, no privileges required, no user interaction, and low impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker to induce the server to make arbitrary requests, which could lead to information disclosure or interaction with internal systems depending on the server environment. However, the impact is limited by the high complexity and low confidentiality, integrity, and availability impacts as per the CVSS vector. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should monitor for updates from kalcaddle. Until a patch is released, consider restricting access to the affected components or implementing network-level controls to limit outgoing requests from the server to untrusted destinations.