CyberRota Analysis
AI-GeneratedThe Kira-Pgr PromptShopMCP's Image-Toolkit-MCP-Server is vulnerable due to a server-side request forgery (SSRF) flaw in the download_image function of server.py, which can be exploited remotely by manipulating the image_url argument. This vulnerability poses a medium risk, as it may allow attackers to access internal resources or services. Organizations using this product should prioritize remediation, especially those relying on the affected component for image processing or server interactions.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A vulnerability was found in Kira-Pgr PromptShopMCP up to 5bc0cd17358e19a5415d11a531088170d7b81452. Affected is the function download_image of the file server.py of the component Image-Toolkit-MCP-Server. Performing a manipulation of the argument image_url results in server-side request forgery. The attack may be initiated remotely. The exploit has been made public and could be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.