An unauthenticated Server-Side Request Forgery vulnerability in Zenith Satellite Tracker 1.0 creates a critical risk of internal network compromise and sensitive data exposure.

The vulnerability exists within the sat_proxy.php script, which fails to validate the host or scheme of an attacker-provided URL parameter before passing it to curl_setopt. This allows an unauthenticated remote attacker to force the server to initiate arbitrary HTTP or HTTPS requests, effectively bypassing network boundaries.

Successful exploitation of this vulnerability permits an attacker to interact with internal services that are not exposed to the public internet, such as cloud metadata services or internal management interfaces. Given the CVSS score of 9.8, this represents a critical threat that could lead to full system compromise, data exfiltration, or lateral movement within the corporate network.

Immediate Action: Since no official patch is currently identified, administrators should restrict access to the affected sat_proxy.php script via network-level controls or by disabling the vulnerable component until a vendor-supplied update is available.

Proactive Monitoring: Review web server access logs for unusual requests containing URL parameters that point to internal IP addresses or sensitive cloud metadata endpoints (e.g., 169.254.169.254).

Compensating Controls: Deploy a Web Application Firewall (WAF) to inspect and block incoming requests containing suspicious URL strings or attempts to access internal resources via the proxy script.

Public Exploit Available: Unknown.

Due to the critical nature of this SSRF vulnerability and the potential for unauthenticated access to internal infrastructure, immediate action is required. Organizations should isolate the vulnerable Zenith Satellite Tracker instance and monitor for any signs of unauthorized internal scanning until a formal security patch is released by the vendor.