Team scope authorization bypass when Post/Put request with :team_name in body, allows HTTP parameter pollution

Impact For some Post/Put Concourse endpoint containing :teamname in the URL, a Concourse user can send a request with body including :teamname=team2 to bypass team scope check to gain access to certain resources belong to any other team. The user only needs a valid user session and belongs to...

Amauta Consultores CMS SQL Injection

Exploit Title : AMAUTA CONSULTORES CMS SQL Injection Vulnerability Author : Secure-Land Security Team Discovered By : farbodmahini Home : Secure-Land.net Vendor : www.amautaperu.com Contact : [email protected] , [email protected] Security Risk : High DorK : "Powered by AMAUTA CONSULTORES...