A product stock-check feature accepts a full URL in a POST b…
A product stock-check feature accepts a full URL in a POST body. Attacker changes: stockApi=http://stock.weliketoshop.net:8080/… to stockApi=http://127.0.0.1/admin The server fetches internal admin content and returns it. This is:
Read Details