myMagicPower AIAS Server-Side Request Forgery Vulnerability

A critical server-side request forgery (SSRF) vulnerability has been identified in myMagicPower AIAS version 20250308. The issue arises in an unknown function within the file 'InferController.java', located in the '2_training_platform/train-platform/src/main/java/top/aias/training/controller/' directory. This vulnerability allows remote attackers to manipulate the 'url' argument, potentially leading to unauthorized requests being sent from the server.

Impact

Exploitation of this vulnerability allows for server-side request forgery, where an attacker can make the server send requests on its behalf. This could be used to access internal services or resources that are not normally exposed to the outside world.