Interceptor
MediaHub hides its logic in the traffic: a leaked backup gives the admin password format, a forged is_verified field skips the OTP, and a decimal-IP curl injection reads the flag off disk.
Writeups
Interceptor
MediaHub hides its logic in the traffic: a leaked backup gives the admin password format, a forged is_verified field skips the OTP, and a decimal-IP curl injection reads the flag off disk.
Operation Coldstart
A forgotten staging box: anonymous FTP leaks the source, an allow-list that resolves to localhost turns the URL previewer into an SSRF, and a tar wildcard in a root backup cron finishes the job.