What can be more exciting than being authorized to test one of the most hyped companies in 2016?
- The JNews component was found to be vulnerable to SQL Injection affecting multiple pages.
- The AcyMailing component was vulnerable to SQL Injection on the export controller. This was another issue discovered by me, Filipe and Vitor while we were looking for low-hanging fruits in the TOP Joomla plugins.
- JEvents component was vulnerable to SQL Injection on new events functionality. This vulnerability was located inside the backoffice.
- A post disclosing some details of an Insecure Direct Object Reference (IDOR) vulnerability discovered in the latest version of osTicket, back in 2015. I decided to dig into the internals of this product for the challenge and the fun, nothing else. The vulnerability was fixed by osTicket in one day.