pentester.land· Jan 3, 2023· by Sam Curry (@samwcyo), Neiko Rivera (@_specters), Brett Buerhaus (@bbuerhaus), Maik Robert (@xEHLE_), Ian Carroll (@iangcarroll), Justin Rhinehart (@sshell_), Shubham Shah (@infosec_au)

Web Hackers vs. The Auto Industry: Critical Vulnerabilities in Ferrari, BMW, Rolls Royce, Porsche, and More

Open Original Article ↗

Target Program: Kia, Honda, Infiniti, Nissan, Acura, Mercedes-Benz, Hyundai, Genesis, BMW, Rolls Royce, Ferrari, Spireon, Ford, Reviver, Porsche, Toyota, Jaguar, Land Rover, SiriusXM

🎯 Vulnerability: Remote Code Execution (RCE)

💡 Defense Fix: Avoid executing shell commands via system(). Use parameterized APIs and strict input sanitization.

#Account takeover#SSO#RCE#Authorization bypass#SQL injection#Mass assignment#Information disclosure

Web Hackers vs. The Auto Industry: Critical Vulnerabilities in Ferrari, BMW, Rolls Royce, Porsche, and More

More Writeups Like This

Bucket Monopoly: Breaching AWS Accounts Through Shadow Resources

Technical Advisory – Multiple Vulnerabilities in PandoraFMS Enterprise

Critical Bug Bounty Reports: Part 1

Zero click vulnerability in Apple’s macOS Mail