writeups.xyz / SSRF and Account Takeover via XSS in ERPNext (0-day)

Submitter : c2a

Date: 6 April 2022

Bounty : undisclosed

Vulnerabilities :

• SSRF
• XSS
• Account Takeover

Programs :

• ERPNext

Authors :

• Huli (@Aszx87410)

Link :
https://tech-blog.cymetrics.io/en/posts/huli/erpnext-ssrf-and-xss-to-account-takeover/