Recent content by cyanidee

Hello Kirby, I am glad for your answer however I am a bit skeptical about your claims of having an admin account could do pretty much anything. Can you perhaps give me some code to put in a template that can read files, any type of SSRF or anything remotely similar (not including XSS)?

I have read the CVE report you provided and it is different to the exploit I have found and is not the same at all. The CVE you mentioned was an XSS vulnerability which was executed on the client side, which in the worst case scenario would be able to steal a users cookies or edit the page to...

Exploit possibilities: Arbitrary File Read : Access and exfiltrate sensitive files on the server, such as config.php (containing database credentials) and /etc/passwd. Server-Side Request Forgery (SSRF) : Bypass firewalls, access internal systems, and retrieve the origin IP address of the server...