VK.com · Report #296622
Blind XXE on pu.vk.com
Validstatus
mediumseverity
$500bounty
18upvotes
4 Mar 2018disclosed
Summary
Blind XXE vulnerability in processing of uploaded documents.
Blind XXE vulnerability in processing of uploaded XML-documents such as docx.
Vulnerability was hard-exploitable, because all data retrieval channels did not work except DNS.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.