3 ms·

You say that you're "confident" you could have found another attack-- do you mean... What I read into that is that the prevention of shell injection attacks is

You say that you're "confident" you could have found another attack-- do you mean... What I read into that is that the prevention of shell injection attacks is so basic that it's likely that there are other vulnerabilities as well. For example, they're probably saving the name of the stored encrypted file into the database. Since they have a record of not checking the file extension, I'd look for the analogous SQL injection vulnerability when they do the DB insert.

Cushman 16y ago
Or conversely, the shell injection vulnerability is fairly obscure — forgetting to validate the extension, not something you'd usually think of as user-provided input. This indicates that there was a modicum of concern for validation, they just weren't approaching it rigorously. It's a cause for suspicion of further vulnerabilities, but not confidence. One vulnerability is not two vulnerabilities.