Razer Synapse Service 1.0.0 DLL Injection

Discovered by: Juan Sacco Razer Synapse Service v1.0.0 is prone to a DLL Injection because it fails to properly filter user supplied input and loads a .DLL from %ProgramData% from userland with SYSTEM rights allowing to escalate the priveleges from a regular user to SYSTEM rights. Program: Raze...

Razer: 🐞 OS Command Injection at https://sea-web.gold.razer.com/lab/ws-lookup via IP parameter

The tester discovered a Razer Gold Thailand site that suffered from a service with a command injection vulnerability. Razer thanks the tester for his report and clear PoC. a real world CTF-Like challenge 😅 Burpsuite Collaborator Client was very helpful Thanks @Razer for the bounty 🥳...

Razer: SQL injection at https://sea-web.gold.razer.com/ajax-get-status.php via txid parameter

The tester determined the Razer Gold TH site suffered from a SQL injection issue. Razer thanks the tester for his due diligence and clear report...

Razer: Subdomain takeover at iosota.razersynapse.com via Amazon S3

The tester discovered a dangling DNS record for iosota.razersynapse.com that was no longer in use and demonstrated a subdomain takeover. Subdomain takeovers by themselves are not in the scope of our program, but Razer thanks the tester for their diligence and clear report...

Razer: SQL Injection in https://api-my.pay.razer.com/inviteFriend/getInviteHistoryLog

The tester determined the Razer Pay API server was vulnerable to a SQL injection that could allow the exposure of user information. Razer Fintech appreciates the clear and detailed PoC...

Razer: Helpdesk takeover (subdomain takeover) in razerzone.com domain via unclaimed Zendesk instance

The tester discovered a Razer subdomain subject to a takeover. Although we do not normally accept these as part of this program, Razer thanks the tester for his report...

Razer: Post Based Reflected XSS on [https://investor.razer.com/s/ir_contact.php]

The tester discovered our investor relations website suffered from a reflected XSS issue due to unsanitized user input. Razer thanks the tester for his clear PoC and working with us to resolve this issue...

Razer: Reflected XSS on molpay.com with cloudflare bypass

The tester discovered a reflected XSS vulnerability on molpay.com which could allow an adversary to steal client side information such as a cookie. Razer Fintech thanks the tester for his clear report and PoC. Follow brutelogic for amazing bypass tips. Thank you for bounty @razer 🙏...

Razer: Insecure HostnameVerifier within WebView of Razer Pay Android (TLS Vulnerability)

The tester discovered the Razer Pay Android application was vulnerable to a client side hijack which could have allowed the capture of important user data. Razer Fintech thanks the tester for their clear PoC...

Razer: RXSS at https://api.easy2pay.co/inquiry.php via txid parameter.

The tester discovered a reflected XSS on an API server related to Razer Pay TH. Note this is not a site that users will typically visit via a web browser front end. Razer thanks the tester for his diligence and the clear report...

Razer: Blind SQL Injection at http://easytopup.in.th/es-services/mps.php via serial_no parameter

The tester determined a Razer Gold Thailand server was vulnerable to a boolean-based blind SQL injection attack. Razer thanks the tester for the very clear PoC...

Razer: IDOR in eform.molpay.com leads to see other users application forms with private data

The tester discovered an IDOR which could allow an adversary to view the application form data of another user's application form given knowledge of the application ID. He worked with Triage to provide a working PoC. Razer Fintech appreciates the report to help keep customer data secure...

Razer: Reflected XSS in eform.molpay.com

The tester discovered a reflected XSS on eform.molpay.com. This was fixed in production on Feb 12. Razer Fintech thanks the tester for his diligence and clear PoC...

Razer: Blind SQL Injection(Time Based Payload) in https://www.easytopup.in.th/store/game/digimon-master via CheckuserForm[user_id]

The tester determined the Top Up site for Razer Gold TH suffered from a blind SQL injection vulnerability due to lack of input sanitization. Razer thanks the tester for his clear PoC and working with us to resolve the issue...

Razer: AWS subdomain Takeover at estore.razersynapse.com

The tester discovered the razersynapse.com domain was vulnerable to a subdomain takeover. Although this is out of scope of our program, we appreciate the tester bringing this to our attention...

Razer: DOM-based XSS on https://zest.co.th/zestlinepay/

The tester discovered a DOM based XSS on a Razer Gold Thailand associated website that could allow stealing of user session cookies. He provided excellent reproduction steps and a video PoC. Razer thanks the tester for his great report and helping us to keep our customers' information secure...

Razer: https://zest.co.th/zestlinepay/checkproduct API endpoint suffers from Boolean-based SQL injection

The tester discovered an unused service that suffered from a SQL injection vulnerability. This service was removed. Razer thanks the tester for his detailed work and report...

Razer: Leftover back-end system on www.zest.co.th allows an unauthorized attacker to generate Razer Gold Pin for free

The tester discovered a residual backend system was left exposed. The system was removed from public access. Razer thanks the tester for his diligence...

Razer: SQL Injection at https://sea-web.gold.razer.com/lab/cash-card-incomplete-translog-resend via period-hour Parameter

The tester discovered a SQL injection issue that allowed access to data via Razer Gold Thailand's sea-web server. Razer appreciates the clear and thorough report...

Razer: SQL injection at https://sea-web.gold.razer.com/demo-th/goto-e2p-web-api.php via Multiple Parameters

The tester discovered a SQL injection vulnerability that allowed the potential extraction of information from a Razer Gold database. Although this turned out to be an unused service, we thank the tester for his diligence...