Technical impact
The vulnerability resides in the CheckDatabaseRequest.php file of Invoice Ninja and permits a server‑side request forgery. By manipulating the request, an attacker can instruct the server to send HTTP or other protocol requests to arbitrary destinations. This can be used to reach internal networks, disclose internal resources, or interact with services that are otherwise not exposed externally. The weakness is classified as CWE‑918 and does not directly grant code execution, but it can serve as a stepping‑stone to further attacks.
Affected Systems
The affected product is Invoice Ninja, specifically versions 5.12.46 and 5.12.48. No alternate vendors or product lines are noted as impacted.
Risk and Exploitability
The CVSS score of 7.7 denotes a high severity level. The EPSS score of less than 1% suggests that, as of now, the likelihood of exploitation is low, and the vulnerability is not listed in the CISA KEV catalog. The most probable attack vector involves a remote attacker sending a crafted request to the Setup/CheckDatabase endpoint. If the endpoint is reachable from the public internet or to authenticated users, an attacker could leverage the SSRF to exfiltrate data or reach internal services, potentially leading to a broader compromise. The overall risk depends on the exposure level of the vulnerable endpoint.
