A Server‑Side Request Forgery vulnerability exists in the judge_server_heartbeat service_url function of QingdaoU OnlineJudge, allowing an attacker to instruct the server to make arbitrary HTTP requests on its behalf. The vulnerability can be triggered remotely, enabling potential internal network discovery, data exfiltration, or malicious interactions with other services, thereby compromising confidentiality and possibly availability. The weakness aligns with CWE‑918, a well‑known SSRF flaw.

QingdaoU OnlineJudge versions up to and including 1.6.1 are affected. Users running this or earlier releases are susceptible to the SSRF attack via the service_url endpoint of the judge_server_heartbeat module.

The reported CVSS v3 score of 5.3 indicates moderate severity. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been widely exploited. However, the remote nature of the exploit and the ability to command outbound connections present a tangible risk. Attackers would need network access to the system and could leverage the endpoint to reach internal or external resources, making the threat credible in environments with exposed interfaces.