CVE-2025-56563: Server-Side Request Forgery in Zenith Satellite Tracker

**CVE-2025-56563 — Zenith Satellite Tracker 1.0 (sat_proxy.php) SSRF, CVSS 9.8 (Critical):** An unauthenticated full-response Server-Side Request Forgery in the sat_proxy.php endpoint allows attackers to force the server to make arbitrary outbound requests (including to localhost, RFC1918 ranges, and cloud metadata endpoints), enabling credential theft, internal network reconnaissance/pivoting, and use as an open proxy. The report provides PoC examples, impact assessment, and recommended mitigations such as disabling the proxy, implementing allow-listing and egress restrictions, enforcing IMDSv2, and adding WAF/reverse-proxy rules.