Summary

There is full SSRF in /api/upload.php

Details

The /api/upload.php allows any URL, causing SSRF. Note that here other protocols like file:// can also be used
The request result (on success) can then be retrieved using /api/download.php

PoC

1. Set up a server to listen on localhost:8000 on server side.
2. Send an authenticated request to /api/upload.php?url=http://localhost:8000, record blob id
3. Observe a request being sent to localhost:8000
4. Send an authenticated request to /api/download.php?blob=blobid
5. Get the server side request result.

If change url to file:///etc/passwd, the local file /etc/passwd can also be fetched

Impact

See https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29/
Refer to https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html for proper fixes.