DBMS information getting exposed publicly on -- [ ██████████ ]
该报告还没有中文解读。
原文摘录
摘自原文（3233 字符中的一小部分）
hi there, when i was working on your [domain](█████). i got to know that website is using drupal. and after a long fuzzing i found a file on your domain which was leaking some user hashed and data stored in your DBMS this data could be confidential to you so i am mentioning it below make sure to …
原文中的代码
$connection->insert('aggregator_feed')
->fields(array(
'fid',
'uuid',
'langcode',
'title',
'url',
'refresh',
'checked',
'queued',
'link',
'description',
'image',
'hash',
'etag',
'modified',
))
->values(array(
'fid' => '1',
'uuid' => …默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 U.S. Dept Of Defense 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @dishant_singh · 版权归作者与 U.S. Dept Of Defense 所有