Siefr3Dus

An authenticated user with System Administrator privileges can trigger a server-side request forgery (SSRF) through the WOPI service discovery URL. This allows access to internal hosts and ports, and the response body can be exfiltrated using the built-in debug system, resulting in a visible SSRF and enabling full server-side file read.

Group-Office is a customer relationship management and groupware tool. The `MaintenanceController` includes a `zipLanguage` action that uses a `lang` parameter directly in a system zip command via the `exec()` function. This can be exploited by uploading a specially crafted zip file, leading to remote code execution. The `lang` parameter is not properly filtered, allowing for command injection.