We first intercepted the request after clicking the Check Stock button to see the request :
We were able to access the admin panel using http://localhost/admin to the stockApi parameter in the request :
However, We failed to remove the carlos user from there as we got prompted with this error :
We copied the link that will trigger the deletion of the user to our clipboard and used that url encoded in the stockApi parameter :
http://localhost/admin/delete?username=carlos
While visiting the /admin panel again from the SSRF, We were able to see that we have solved the lab :
