Greetings, Summary I tested Xss on Intel main domain, then “inter_searchTerm” parameter come out. This situation made me suspicious. I tried some Xss payloads in this parameter and i found. I noticed that when I viewed http header information, it was sql injection. This cookie parameter affected the whole domain because it is in all subdomains.
Greetings, Summary Vulnerability allows you to confirm a phone number or mail that you own or not. So you have bypassed the two factor authentication verification. Two-step verification must be active so leak can ocur. At the same time, the 2fa verification must be mandatory by the administrator. You can add the phone number or e-mail address to the corporate e-mail address without knowing it. This is very big in terms of computer forensic. A criminal offense may appear attached to your email address as confirmed by your phone. So you can be in a criminal position. Think that your phone number has been approved at wannacry’s email address, Hello FBI it’s not me, it’s 0day 🙂
Özet Oracle bug bounty kapsamında yaptığım çalışmada stored xss ve ssrf zafiyetlerini tespit ettim. Örnek bir senaryoda kullanıcı bilgileri çalınabilir, sunucudaki dosyalar okunabilir ve cloudflare arkasındaki ip adresi öğrenilebilir sunucuda kod çalıştırılabilirdi.