writeups.xyz / Leaking File Contents with a Blind File Oracle in Flarum

Submitter : c2a

Date: 28 August 2023

Bounty : undisclosed

Vulnerabilities :

• PHP Filter Chain
• Arbitrary File Read
• LFI
• Security Code Review

Programs :

• Flarum

Authors :

• Adam Kues (@Hash_kitten)

Link :
https://blog.assetnote.io/2023/08/28/leaking-file-contents-with-a-blind-file-oracle-in-flarum/