Email Template Draft Feature Triggers SSRF, Earns ¥3000!

Hello hackers,

I’m a bounty hunter from China, and today I’m sharing a bounty project I encountered domestically. Due to confidentiality, I cannot disclose any specific information about it.

The target was an e-commerce management system.

After exploring its various features, I noticed an interesting one — email marketing.

It allows users to create new templates, which was my main testing focus.

When I casually filled in the template content and clicked ‘save draft’, pay attention to the data packet.

Did you notice anything?

Perhaps you noticed the templateId.

Yes, I tested the templateId parameter, trying to modify it to a different ID, and found that the backend…