Uber · Report #206872
SQL injection in 3rd party software Anomali
Validstatus
highseverity
$2,500bounty
61upvotes
21 Mar 2017disclosed
Summary
SQLi in Anomali from Threatstream on ts02.uberinternal.com -- the server was hosted outside of our infrastructure and any potential data exposure was limited to Uber employees, not Uber users.
It was a pleasure working with @kazan71p and we look forward to more reports in the future.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.