writeups.xyz / ZeroQlik: Achieving Unauthenticated Remote Code Execution via HTTP Request Tunneling and Path Traversal

Submitter : c2a

Date: 31 August 2023

Bounty : undisclosed

Vulnerabilities :

• RCE
• Path Traversal
• HTTP Request Tunneling
• HTTP Request Smuggling
• Security Code Review

Programs :

• Qlik

Authors :

• Adam Crosser

Link :
https://www.praetorian.com/blog/qlik-sense-technical-exploit/