A Server‑Side Request Forgery (SSRF) exists in the serviceURL parameter of ProPhoenix Law RMS v2022.2403.3.101, allowing an attacker to compel the server to resolve DNS names and issue HTTP requests that were not intended by the application. This flaw can expose internal network details and potentially give attackers access to internal services, thereby compromising confidentiality and availability of those resources.

The vulnerable product is ProPhoenix Law RMS, version 2022.2403.3.101. No vendor patch or work‑around is documented in the available data, and the provider is unknown.

Because the exploit requires crafting a HTTP request that targets the serviceURL field, the attack vector is likely remote via publicly accessible endpoints. The CVSS score of 6.5 indicates a medium severity; the EPSS score of less than 1% implies a low probability of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog, but SSRF remains a high‑risk vulnerability that could allow attackers to reach internal network resources, potentially exposing sensitive data or interrupting services.