Pngyuo

**Name of the Vulnerable Software and Affected Versions** Casdoor versions prior to 4.11.0 **Description** A remote server-side request forgery exists in the Proxy Validation component. The issue occurs within the `CasP3ProxyValidate()` function located in the controllers/cas.go file, where manipulation of the `pgtUrl` argument allows an attacker to induce the server to make unauthorized requests. **Recommendations** Upgrade to version 4.11.0. As a temporary mitigation, restrict access to the `CasP3ProxyValidate()` function.