Threats tagged 'ghsa-pvfv-6672-6xqp'

A Server-Side Request Forgery (SSRF) vulnerability exists in the sat_proxy.php script of Zenith Satellite Tracker 1.0. The vulnerability arises because the script accepts a user-controlled URL parameter and uses it in a curl request without validating the host or scheme. This allows an unauthenticated remote attacker to make arbitrary HTTP or HTTPS requests from the server to internal networks or cloud metadata services, potentially exposing sensitive information or enabling further attacks.