CVE-2021-27312: 
PHP vulnerability analysis and mitigation

A Server Side Request Forgery (SSRF) vulnerability exists in Gleez CMS version 1.2.0 that allows remote attackers to execute arbitrary code and obtain sensitive information. The vulnerability occurs when '://' is present in the URL path, causing GleezCMS to use the cURL library to send requests specified by the attacker (GitHub Issue).

The vulnerability exists due to improper validation of URLs in the Request::factory function. The $allow_external parameter is set to TRUE by default in the Request::__construct method, which enables support for external proxies. When a URL containing '://' is processed, the application uses cURL to make the request to the specified destination. The vulnerability is particularly concerning because cURL supports the gopher protocol, which can be used to attack php-fpm, redis, memcached and other internal services (GitHub Gist).

The impact of this vulnerability is severe as it allows attackers to make unauthorized requests to internal services and potentially achieve remote code execution. Through the gopher protocol support, attackers can target internal services like php-fpm, redis, and memcached. This could lead to unauthorized access to sensitive information and potential system compromise (GitHub Issue).

The vulnerability can be exploited by sending specially crafted URLs containing '://' in the path. Example proof-of-concept URLs include 'https://gleezcms.org/http%3A%2F%2Fwww.google.com' and 'https://gleezcms.org/gopher%3A%2F%2F127%2E0%2E0%2E1%3A9000%2F%5Ftest'. The exploitation requires no authentication and can be performed remotely (GitHub Gist).