This vulnerability in Qibo CMS 1.0 allows remote attackers to perform server-side request forgery by manipulating the 'starts' argument in the /index/image/headers functionality. SSRF vulnerabilities enable attackers to make the server send crafted requests to internal or external systems, potentially bypassing network restrictions. The issue is publicly known, but the vendor has not provided any fix or guidance. The CVSS 4.0 vector indicates low complexity and no user interaction required, with limited impact on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker to cause the server to make arbitrary HTTP requests, potentially accessing internal resources or services not otherwise reachable. However, the impact is limited as per the CVSS vector, indicating low confidentiality, integrity, and availability impact. There is no evidence of active exploitation in the wild at this time.

No official fix or patch is currently available from the vendor, and the vendor has not responded to the disclosure. Organizations using Qibo CMS 1.0 should consider implementing network-level controls to restrict outbound requests from the affected server to trusted destinations only. Monitoring and blocking suspicious outbound traffic may reduce risk until a vendor patch is released. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.