Webshell via File Upload on ecjobs.starbucks.com.cn
该报告还没有中文解读。
原文摘录
摘自原文(5694 字符中的一小部分)
**Summary:** OS Command Injection which can let the attacker who get more important information of the server,such as disclosures internal source code of the webapp,database data and invade the internal network.
原文中的代码
After that you have uploaded malicious files on the server and run any os command on server you wanted. Do some command like list all files on the server
默认不展示报告全文。以上为简短摘录,完整复现过程请阅读原文。版权归研究员与 Starbucks 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @johnstone · 版权归作者与 Starbucks 所有