MediaHub hides its logic in the traffic: a leaked backup gives the admin password format, a forged is_verified field skips the OTP, and a decimal-IP curl injection reads the flag off disk.