Hi,

Excuse me, but I don't see any area where to report security issues, given the history of other users, I will put it here, but it would be highly advisable that you quickly fix the vulnerability and/or put this issues in private format until corrected.

**Description**
The current version of SLiMS 9.6.0 presents a high/critical vulnerability, since it allows an authenticated user with access to the "scrape_image.php" file to send requests to internal services or load the content of very relevant internal files (system files, configuration files, backup, SSH keys, etc...) over the "imageURL" parameter.

**Proof of Concept:**
The following illustration shows how the malicious user can manage to load the contents of the "index.html" file of the internal web server on port 80 (port not exposed externally), showing that the attacker would not only manage to find out internal services, but could extract the information in image format encoded in base64.

<img width="852" alt="SLiMS 9 6 0 - ssrf - 2" src="https://github.com/slims/slims9_bulian/assets/54067582/b52c8ff8-b458-4adb-9be7-03e6b5f92267">

In addition, this can allow to reach relevant files of the website, in this case it has been used to extract a backup of the site's database.
<img width="854" alt="SLiMS 9 6 0 - ssrf - 4" src="https://github.com/slims/slims9_bulian/assets/54067582/cfbb8499-aae5-4dc9-a674-6f5ab449db89">

Finally, the vulnerability has been used to reach an internal file of the machine, this could be used to reach other files where SSH credentials or keys are exposed, gaining illegitimate access to the server and compromising the machine.

<img width="852" alt="SLiMS 9 6 0 - ssrf - 5" src="https://github.com/slims/slims9_bulian/assets/54067582/355af964-7807-41ba-99d7-de9869336a51">

**Expected behavior**
The application should only load files with image format (png, gif, jpg, etc...) and from a specific path of the application, preventing the path to be altered arbitrarily and from the client side.

In addition, it should be prevented from loading to internal paths or external servers not allowed by the application and/or organization, thus preventing it from being possible to identify and reach internal resources or reach malicious external sources to load malicious code.

Best regards,
SLiMS 9.6.0 - Server-Side Request Forguery (SSRF) & Local File Inclusion (LFI)
This is a GitHub Issue
repo:slims9_bulian
owner:slims
Title : SLiMS 9.6.0 - Server-Side Request Forguery (SSRF) & Local File Inclusion (LFI)
Issue date:

--- start body ---
Hi,

Excuse me, but I don't see any area where to report security issues, given the history of other users, I will put it here, but it would be highly advisable that you quickly fix the vulnerability and/or put this issues in private format until corrected.

**Description**
The current version of SLiMS 9.6.0 presents a high/critical vulnerability, since it allows an authenticated user with access to the "scrape_image.php" file to send requests to internal services or load the content of very relevant internal files (system files, configuration files, backup, SSH keys, etc...) over the "imageURL" parameter.

**Proof of Concept:**
The following illustration shows how the malicious user can manage to load the contents of the "index.html" file of the internal web server on port 80 (port not exposed externally), showing that the attacker would not only manage to find out internal services, but could extract the information in image format encoded in base64.

<img width="852" alt="SLiMS 9 6 0 - ssrf - 2" src="https://github.com/slims/slims9_bulian/assets/54067582/b52c8ff8-b458-4adb-9be7-03e6b5f92267">

In addition, this can allow to reach relevant files of the website, in this case it has been used to extract a backup of the site's database.
<img width="854" alt="SLiMS 9 6 0 - ssrf - 4" src="https://github.com/slims/slims9_bulian/assets/54067582/cfbb8499-aae5-4dc9-a674-6f5ab449db89">

Finally, the vulnerability has been used to reach an internal file of the machine, this could be used to reach other files where SSH credentials or keys are exposed, gaining illegitimate access to the server and compromising the machine.

<img width="852" alt="SLiMS 9 6 0 - ssrf - 5" src="https://github.com/slims/slims9_bulian/assets/54067582/355af964-7807-41ba-99d7-de9869336a51">

**Expected behavior**
The application should only load files with image format (png, gif, jpg, etc...) and from a specific path of the application, preventing the path to be altered arbitrarily and from the client side.

In addition, it should be prevented from loading to internal paths or external servers not allowed by the application and/or organization, thus preventing it from being possible to identify and reach internal resources or reach malicious external sources to load malicious code.

Best regards,
--- end body ---

The SLiMS 9.6.0 application is vulnerable to Server-Side Request Forgery (SSRF) and Local File Inclusion (LFI) through the 'scrape_image.php' file. An authenticated user can exploit the 'imageURL' parameter to send requests to internal services or load sensitive internal files, such as configuration files and SSH keys. This vulnerability can lead to unauthorized access to internal resources and potential compromise of the server.