Yuval

@yeswehack replace() will replace a single instance of '"' instead of the desired behavior, replacing every instance, that can be achieved using replaceAll(). Thus we can perform SQLi by using a payload similar to this - '"";DROP TABLE users;#'.

Vulnerable Code Snippet 💀 Level: Easy 🪲 Does it only work once?! For all #BugBounty hunters, it is available on Github for hands-on testing! 👉 github.com/yeswehack/vuln… #YesWeRHackers Found the issue? Explain how in the comments! 👇

@yeswehack @yeswehack Besides LFI using methods already commented, there is a reflected XSS vuln. 'http://e.vil/p.html' will be filtered, but we can use the fact filtering '://' is separate from '../' to construct 'http:..///e.vil/p.html' and file is a GET param so we can send bad link.

Vulnerable Code Snippets Time 🥷 Level: Medium 🐝 This web application does not like dot dot slash! Try it out at Github: github.com/yeswehack/vuln… #BugBounty #YesWeRHackers Found the issue? Explain how in the comments! 👇 🎁 The best solution gets an exclusive swag!

@yeswehack @yeswehack After a password reset link is used, resetHash is called with $reset=true. $hs is bound to the prepared statement with a type of string(s) and NULL will not change the resethash column. Thus the same hash can be used indefinitely to reset a user's password.

Vulnerable code snippets time ⏳ Level: Hard 🐞 (code analysis) Would you like to update "your" password? 🫵🔐 Github: github.com/yeswehack/vuln… #BugBounty #YesWeRHackers Found the issue? Explain how in the comments!

@Turmio_ Oh it's trying to merge the files into the symlink, now I get it. Brilliant plan! Thanks for explaining further.

@yuvalgal_ Thanks! Uncleaned symlink is in tempdir. Second zip gets extracted to same tempdir and since there is symlink named "Mail" already, all the files in second zip which are extracted to Mail directory will actually follow the symlink.

I found a zero click vulnerability in Apple Mail. Here are the details and story behind it: mikko-kenttala.medium.com/zero-click-vul… #infosec #vulnerability #apple