SSRF in graphQL query (pwapi.ex2b.com)