pentester.land· Jul 11, 2021· by Greg Gibson

Critical Bug Bounty Reports: Part 1

Open Original Article ↗
Target Program: -
🎯 Vulnerability: Remote Code Execution (RCE)
💡 Defense Fix: Avoid executing shell commands via system(). Use parameterized APIs and strict input sanitization.
#Account takeover#Password reset#RCE#Information disclosure

More Writeups Like This

pentester.land

Bucket Monopoly: Breaching AWS Accounts Through Shadow Resources

by Yakir Kadkoda, Ofek Itach, Michael Katchinskiy
pentester.land

Technical Advisory – Multiple Vulnerabilities in PandoraFMS Enterprise

by Oliver Brooks
pentester.land

Account takeover vulnerability that resulted in $2500 bounty!

by Imad Husanovic (@deadoverflow_)
pentester.land

Web Hackers vs. The Auto Industry: Critical Vulnerabilities in Ferrari, BMW, Rolls Royce, Porsche, and More

by Sam Curry (@samwcyo), Neiko Rivera (@_specters), Brett Buerhaus (@bbuerhaus), Maik Robert (@xEHLE_), Ian Carroll (@iangcarroll), Justin Rhinehart (@sshell_), Shubham Shah (@infosec_au)