POJIA破甲
地图 / CVE-2018-6389 exploitation - using scripts loader

CVE-2018-6389 exploitation - using scripts loader

业务逻辑 / 业务逻辑错误 / #925425

厂商
MTN Group
严重程度
中危
赏金
—
弱点
业务逻辑错误
研究员
@lmhu
披露日期
2021-08-18
资产
www.mtn.zm
CVE
CVE-2018-6389

该报告还没有中文解读。

原文摘录

摘自原文(6423 字符中的一小部分)
**Issue Description** Unauthenticated attackers can cause a denial of service (resource consumption) by using the large list of registered .js files (from wp-includes/script-loader.php) to construct a series of requests to load every file many times. The vulnerability is registered as …
原文中的代码
eutil,common,wp-a11y,sack,quicktag,colorpicker,editor,wp-fullscreen-stu,wp-ajax-response,wp-api-request,wp-pointer,autosave,heartbeat,wp-auth-check,wp-lists,prototype,scriptaculous-root,scriptaculous-builder,scriptaculous-dragdrop,scriptaculous-effects,scriptaculous-slider,scriptaculous-sound,script …

默认不展示报告全文。以上为简短摘录,完整复现过程请阅读原文。版权归研究员与 MTN Group 所有。

时间线

  • 报告提交
  • 公开披露
阅读 HackerOne 原文 ↗作者 @lmhu · 版权归作者与 MTN Group 所有

同类报告

Modify in-flight data to payment provider Smart2PayValve · 2021-08-10 · $7,500H1514 Ability to MiTM Shopify PoS Session to Takeover CommunicationsShopify · 2019-11-04Hackerone is not properly deleting user idHackerOne · 2021-06-11Double Payout via PayPalCoinbase · 2018-04-04 · $10,000Getting New Invitations without Leaving ProgramsHackerOne · 2020-10-15[fleet.city-mobil.ru] Driver balance increasingMail.ru · —