title: Server-Side Request Forgery in SLiMS
description: Server-Side Request Forgery vulnerability in SLims version 9.6.0. This vulnerability could allow an authenticated attacker to send requests to internal services or upload the contents of relevant files via the "scrape_image.php" file in the imageURL parameter.
problem types: CWE-918 Server-Side Request Forgery (SSRF)
affected:
{
defaultStatus: unaffected
product: SLiMS
vendor: SLiMS
versions:
status: affected, version: 9.6.0
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.9
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions: The vulnerability has been fixed in the latest version of SLiMS.