CVE-2026-10287
Description
SourceCodester SEO Meta Tag Extractor 1.0 is vulnerable to SSRF via the url parameter in index.php, allowing remote attackers to make arbitrary requests.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
SourceCodester SEO Meta Tag Extractor 1.0 is vulnerable to SSRF via the url parameter in index.php, allowing remote attackers to make arbitrary requests.
Vulnerability
A server-side request forgery (SSRF) vulnerability exists in SourceCodester SEO Meta Tag Extractor version 1.0. The vulnerability is located in the index.php file within the fetchMetaTags function, which processes a url POST parameter. The application fails to adequately validate this parameter, passing it directly to get_headers() and file_get_contents() without blocking requests to internal or loopback IP addresses [1].
Exploitation
An attacker can exploit this vulnerability remotely by sending a crafted POST request to the index.php endpoint with a malicious URL in the url parameter. The application will then attempt to fetch headers or content from the attacker-supplied URL. Since file_get_contents() follows HTTP redirects by default, an attacker can chain a redirect to an internal endpoint to bypass basic validation [1].
Impact
Successful exploitation allows an attacker to perform server-side requests to arbitrary internal or external resources. This can lead to the disclosure of sensitive information, interaction with internal services, or other unintended consequences depending on the network environment and accessible internal endpoints. The attacker can leverage this to probe internal networks or interact with services not directly exposed to the internet [1].
Mitigation
SourceCodester SEO Meta Tag Extractor 1.0 has not yet been patched. There are no workarounds available. The vendor's website provides other unrelated projects and tutorials [2].
AI Insight generated on Jun 1, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
1- Range: = 1.0
Patches
0No patches discovered yet.
Vulnerability mechanics
Root cause
"The application fails to validate the network-layer of user-supplied URLs, allowing them to point to internal or private IP addresses."
Attack vector
An attacker can remotely send a POST request to `index.php` with a crafted `url` parameter. This parameter is passed directly to `get_headers()` and `file_get_contents()` without sufficient validation, enabling Server-Side Request Forgery [CWE-918]. The application does not restrict requests to private, loopback, or link-local IP ranges. Additionally, `file_get_contents()` follows HTTP redirects by default, allowing an attacker-controlled URL to redirect the server-side fetch to an internal endpoint, bypassing naive blacklists [ref_id=1].
Affected code
The vulnerability resides in the `fetchMetaTags()` function within the `index.php` file. Specifically, the `url` parameter is passed without adequate validation to the `get_headers()` function at line 8 and `file_get_contents()` at line 13, both of which are sinks for the SSRF vulnerability [ref_id=1].
What the fix does
The advisory recommends a multi-pronged approach to fix the vulnerability. This includes implementing a scheme allowlist for `http` and `https`, resolving hostnames and validating resolved IP addresses against private, loopback, and link-local ranges, and disabling HTTP redirect following by default. Additionally, setting request timeouts and maximum content lengths are suggested to limit abuse for port scanning and denial-of-service attacks [ref_id=1].
Preconditions
- inputThe attacker must be able to send a POST request to the `index.php` endpoint.
- networkThe vulnerable application must be accessible over the network.
Reproduction
1. Deploy SEO Meta Tag Extractor 1.0 on a host with an internal service bound to its loopback interface. 2. Start the vulnerable application using `php -S 0.0.0.0:8080`. 3. From an external host, submit a POST request with the `url` parameter set to an internal address, e.g., `http://127.0.0.1:9999/`. 4. Observe that the HTTP response contains content fetched from the internal service, confirming the SSRF [ref_id=1].
Generated on Jun 1, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
6News mentions
0No linked articles in our index yet.