地图 / Unrestricted File Upload on https://my.stripo.email and https://stripo.email

Unrestricted File Upload on https://my.stripo.email and https://stripo.email

代码执行 / 危险文件上传 / #823588

厂商: Stripo Inc
严重程度: 低危
赏金: —
弱点: 危险文件上传
研究员: @doctor_spooky
披露日期: 2020-04-13
资产: my.stripo.email
CVE: —

该报告还没有中文解读。

原文摘录

摘自原文（2049 字符中的一小部分）

Hi Stripo Inc, I found 2 Unrestricted File Upload Vulnerabilities on your website.

默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Stripo Inc 所有。

时间线

2020-03-18报告提交
2020-04-13公开披露

阅读 HackerOne 原文 ↗作者 @doctor_spooky · 版权归作者与 Stripo Inc 所有

同类报告

Unrestricted file upload leads to Stored XSSVisma Public · — · $250 Unrestricted File Upload on https://partner.tiktokshop.com/wsos_v2/oec_partner/uploadTikTok · 2023-04-12 Tricking the "Create snippet" feature into displaying the wrong filetype can lead to RCE on Slack usersSlack · 2020-06-30 · $1,500 Unrestricted File Upload at ██████████Mars · 2024-02-19 Unrestricted file upload when creating quotes allows for Stored XSSVisma Public · — · $250 [Kafka Connect] [JdbcSinkConnector][HttpSinkConnector] RCE by leveraging file upload via SQLite JDBC driver and SSRF to internal JolokiaAiven Ltd · 2022-11-08 · $5,000