writeups.xyz / A Tale of Two Formats: Exploiting Insecure XML and ZIP File Parsers to Create a Web Shell

Submitter : c2a

Date: 18 February 2020

Bounty : undisclosed

Vulnerabilities :

• XXE
• RCE
• Directory Traversal

Programs :

• Undisclosed

Authors :

• Eugene Lim (@Spaceraccoonsec)

Link :
https://spaceraccoon.dev/a-tale-of-two-formats-exploiting-insecure-xml-and-zip-file-parsers-to-create-a