An SSRF flaw exists in the /settings/webhooks/create route of Webkul Krayin CRM version 2.2.x. A request crafted with a malicious payload can cause the server to fetch arbitrary URLs, enabling an attacker to probe internal network services. This could lead to the disclosure of internal resources or further exploitation if those services have vulnerabilities, compromising confidentiality and potentially availability if service disruption occurs.

Webkul Krayin CRM, specifically version 2.2.x, is affected by this SSRF. The vulnerability resides in the webhook creation component and can be triggered by any user able to submit a POST request to the /settings/webhooks/create endpoint.

With a CVSS base score of 8.5, this issue is classified as high risk. The potential for exploitation is significant because the flaw can be triggered over the network, likely without authentication if access to the webhook creation page is public. While the EPSS score is not available, the absence of an entry in the KEV catalog does not reduce the likelihood of exploitation; the flaw is sufficient to allow internal reconnaissance and possibly launch persistence or privilege escalation attacks against exposed services. No patch is currently available via the vendor, so the vulnerability remains exploitable until remedial action is taken.