POJIA破甲
地图 / Unrestricted File Upload on https://app.lemlist.com

Unrestricted File Upload on https://app.lemlist.com

代码执行 / 危险文件上传 / #722919

厂商
lemlist
严重程度
低危
赏金
—
弱点
危险文件上传
研究员
@ctulhu
披露日期
2020-04-01
资产
app.lemlist.com
CVE
—

该报告还没有中文解读。

原文摘录

摘自原文(584 字符中的一小部分)
Summary: Hi! i found an Unrestricted File Upload on https://app.lemlist.com which let me upload anything. File Extensions Such as .html and others should not be executed on the server side.

默认不展示报告全文。以上为简短摘录,完整复现过程请阅读原文。版权归研究员与 lemlist 所有。

时间线

  • 报告提交
  • 公开披露
阅读 HackerOne 原文 ↗作者 @ctulhu · 版权归作者与 lemlist 所有

同类报告

Unrestricted file upload leads to Stored XSSVisma Public · — · $250Unrestricted File Upload on https://partner.tiktokshop.com/wsos_v2/oec_partner/uploadTikTok · 2023-04-12Tricking the "Create snippet" feature into displaying the wrong filetype can lead to RCE on Slack usersSlack · 2020-06-30 · $1,500Unrestricted File Upload at ██████████Mars · 2024-02-19Unrestricted file upload when creating quotes allows for Stored XSSVisma Public · — · $250[Kafka Connect] [JdbcSinkConnector][HttpSinkConnector] RCE by leveraging file upload via SQLite JDBC driver and SSRF to internal JolokiaAiven Ltd · 2022-11-08 · $5,000