Mail.ru: [ RCE ] Through stopping the redirect in /admin/* the attacker able to bypass Authentication And Upload Malicious File

Combination of improper access control and unrestricted files upload in non-production service led to RCE possibility...