An unauthenticated server-side request forgery vulnerability in Jeson-Customer-Relationship-Management-System allows remote attackers to interact with internal network resources.

This is a Server-Side Request Forgery (SSRF) flaw occurring in the /api/system.php file. An unauthenticated remote attacker can manipulate the url parameter to force the server to initiate arbitrary requests, including access to local files or internal network services.

The ability to perform SSRF allows attackers to bypass perimeter firewalls and interact with sensitive internal services that are not exposed to the public internet. This can lead to unauthorized information disclosure, such as reading local system files, or facilitate deeper lateral movement into the private network. Given the CVSS score of 7.3, this represents a significant risk to organizational infrastructure and data confidentiality.

Immediate Action: Apply the vendor-provided patch corresponding to commit f76e7123fe093b8675f88ec8f71725b0dd186310 immediately.

Proactive Monitoring: Review web server access logs for anomalous requests to /api/system.php containing suspicious URL schemes, such as file:// or gopher://, or requests targeting internal IP addresses.

Compensating Controls: Implement strict network egress filtering on the application server to block outbound connections to internal network ranges and sensitive segments. Use a Web Application Firewall (WAF) to validate and sanitize the input of the url parameter, rejecting requests that do not conform to expected patterns.

Public Exploit Available: Yes — a published proof-of-concept exists, as documented in the researcher's technical write-up on GitHub.

The presence of a functional proof-of-concept for this SSRF vulnerability necessitates immediate action. Administrators must prioritize patching the affected API module to prevent potential internal network reconnaissance and data exfiltration. If patching is not immediately feasible, network-level egress restrictions are mandatory to limit the attacker's ability to reach internal resources.