Starbucks · Report #883151
Singapore - Unrestricted File Upload Leads to XSS on campaign.starbucks.com.sg/api/upload
Validstatus
mediumseverity
61upvotes
22 Jul 2020disclosed
Summary
ko2sec discovered it was possible to upload arbitrary content on https://campaign.starbucks.com.sg/api/upload, leading to a stored XSS. This site was decommissioned.
@ko2sec — thank you for reporting this vulnerability and for confirming the resolution.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.