Razer: 🐞 OS Command Injection at https://sea-web.gold.razer.com/lab/ws-lookup via IP parameter

The tester discovered a Razer Gold Thailand site that suffered from a service with a command injection vulnerability. Razer thanks the tester for his report and clear PoC. a real world CTF-Like challenge 😅 Burpsuite Collaborator Client was very helpful Thanks @Razer for the bounty 🥳...

Razer: Blind SQL Injection at http://easytopup.in.th/es-services/mps.php via serial_no parameter

The tester determined a Razer Gold Thailand server was vulnerable to a boolean-based blind SQL injection attack. Razer thanks the tester for the very clear PoC...

Razer: DOM-based XSS on https://zest.co.th/zestlinepay/

The tester discovered a DOM based XSS on a Razer Gold Thailand associated website that could allow stealing of user session cookies. He provided excellent reproduction steps and a video PoC. Razer thanks the tester for his great report and helping us to keep our customers' information secure...

Razer: SQL Injection at https://sea-web.gold.razer.com/lab/cash-card-incomplete-translog-resend via period-hour Parameter

The tester discovered a SQL injection issue that allowed access to data via Razer Gold Thailand's sea-web server. Razer appreciates the clear and thorough report...

Razer: Reflected XSS on https://www.easytopup.in.th/store/product/return on parameter mref_id

The tester discovered a reflected XSS on Razer Gold Thailand's easytopup.in.th page. We appreciate the excellent POC and code analysis...