Every customer's PDF file was there for the taking
An upload request lets the browser name the storage path of the file the server should go and read, and one field decides whether anybody checks that the path belongs to the person asking.
Electronics Engineer turned ethical hacker and bug bounty hunter. Fascinated by finding security vulnerabilities.
Articles
test2shells - A valid URL with a Command in its Shadow
A connectivity test panel in a bug bounty program took an SSH host, shrugged off thirty minutes of SSRF testing, and never expected a semicolon.
From PDF to Pwn: An Out-of-Band XXE via a vulnerable iText Library
This article explains how I found an XML External Entity (XXE) injection through a specially crafted PDF file.