POJIA破甲
地图 / Webshell via File Upload on ecjobs.starbucks.com.cn

Webshell via File Upload on ecjobs.starbucks.com.cn

代码执行 / 操作系统命令注入 / #506646

厂商
Starbucks
严重程度
高危 · CVSS 10
赏金
—
弱点
操作系统命令注入
研究员
@johnstone
披露日期
2019-11-13
资产
Other non domain specific items
CVE
—

该报告还没有中文解读。

原文摘录

摘自原文(5694 字符中的一小部分)
**Summary:** OS Command Injection which can let the attacker who get more important information of the server,such as disclosures internal source code of the webapp,database data and invade the internal network.
原文中的代码

  After that you have uploaded malicious files on the server and run any os command on server you wanted.
Do some command like list all files on the server

默认不展示报告全文。以上为简短摘录,完整复现过程请阅读原文。版权归研究员与 Starbucks 所有。

时间线

  • 报告提交
  • 公开披露
阅读 HackerOne 原文 ↗作者 @johnstone · 版权归作者与 Starbucks 所有

同类报告

Potential pre-auth RCE on Twitter VPNX / xAI · 2019-08-10 · $20,160Exposed Kubernetes API - RCE/Exposed CredsSnapchat · 2021-07-29 · $25,000🐞 OS Command Injection at https://sea-web.gold.razer.com/lab/ws-lookup via IP parameterRazer · — · $2,000RCE via github importGitLab · 2022-11-16RCE using bash command injection on /system/images (toimitilat.lahitapiola.fi)LocalTapiola · —Remote Code Execution via Extract App PluginNextcloud · 2019-05-30