writeups.xyz / How a simple Directory Listing leads to PII Data Leakage, Remote Code Execution and many more vulnerabilities on a HR management subdomain

Submitter : c2a

Date: 7 May 2023

Bounty : undisclosed

Vulnerabilities :

• RCE
• Unrestricted File Upload
• Stored XSS
• Information Disclosure
• Directory Listing

Programs :

• Undisclosed

Authors :

• Aayush Vishnoi (@AayushVishnoi10)

Link :
https://medium.com/@ar_hawk/how-a-simple-directory-listing-leads-to-pii-data-leakage-remote-code-execution-and-many-more-104b09e644f4