A vulnerability in the _fetch_html function of the Property URL Importer in agit8or1 clientst0r allows an attacker to manipulate the url parameter so that the server operates as a client and makes HTTP requests to arbitrary internal or external destinations. The flaw, identified as CWE‑918, can expose sensitive data, reach internal services, or serve as a foothold for additional compromise. The CVSS base score of 5.3 indicates moderate severity, and publicly available exploits confirm that the issue can be launched remotely.

All versions of agit8or1 clientst0r up to 3.17.586 are affected. The vendor released a fix in version 3.17.587 that addresses the SSRF in the Property URL Importer component. No other versions are listed as affected in the available data.

With a CVSS score of 5.3, the vulnerability is considered moderate. While the EPSS score is not available and the issue is not in the CISA KEV catalog, the presence of a public exploit and the ability to trigger the flaw remotely imply a non-negligible risk. An attacker who can reach the server and supply a crafted URL may access internal resources, exfiltrate data, or pivot to other systems if outbound filtering is absent.