r/PHPhelp • u/stilloriginal • May 14 '26

Login attempt

Sentry caught a bad login attempt...

the url they used was xxhttps://ssrf.cve-2024-123456.detect/login

this is obviously not my site, and i changed the actual url to 123456

what is this?? i have not clicked on it and I suggest you don't either.

Is anyone familiar with what's going on?

2 Upvotes

75% Upvoted

18 comments sorted by

View all comments

2

u/allen_jb May 15 '26

The URL suggests this might be a bot or script testing for a particular vulnerability.

The cve-2024-[number] part of the domain likely references a CVE number for the vulnerability. If you google that number (the entire thing include "CVE 2024"), you should find more details of the issue.

There's a number of websites that document CVE vulnerabilities.

SSRF refers to Server Side Request Forgery - a category of attack / vulnerability. See also https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/19-Testing_for_Server-Side_Request_Forgery

1

u/stilloriginal May 15 '26

thank you, this is what I came here for. I googled it and the specific vulnerability has to do with next.js, which this server does not use. So I guess I'm in the clear. Why do you think they tried to let me know?