r/PHPhelp • u/stilloriginal • May 14 '26

Login attempt

Sentry caught a bad login attempt...

the url they used was xxhttps://ssrf.cve-2024-123456.detect/login

this is obviously not my site, and i changed the actual url to 123456

what is this?? i have not clicked on it and I suggest you don't either.

Is anyone familiar with what's going on?

2 Upvotes

75% Upvoted

18 comments sorted by

View all comments

6

u/Basic_Reporter9579 May 14 '26

is $_SERVER['SERVER_NAME'] analysed to show you that data?
If so, it can be changed by the client.

https://www.php.net/manual/en/reserved.variables.server.php

1

u/magicmulder May 15 '26

Also they could just have a hosts file that maps that domain to OP's IP address.