PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Leaked Secrets and Unlimited Miles: Hacking the Largest Airline and Hotel Rewards Platform

samcurry.net | blog | #bug-bounty | #path-traversal | #pii | #authorization-bypass | #points-com | #loyalty-programs
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Flaws in points.com, backend behind many airline and hotel loyalty programs: path traversal exposed 22 million order records, and an auth bypass enabled points transfers and admin-site access.
Published
Collected

Related coverage

blog · samcurry.net
Hacking Subaru: Tracking and Controlling Cars via the STARLINK Admin Panel
A flaw in Subaru's STARLINK admin panel gave unrestricted access to vehicles and accounts in the US, Canada and Japan—remote commands, a year of location history, PII—keyed on a last name and ZIP.
blog · samcurry.net
Hacking Kia: Remotely Controlling Cars With Just a License Plate
Kia vulnerabilities let attackers remotely unlock, start and track any hardware-equipped vehicle with a license plate—~30 seconds, subscription or not—and add themselves as invisible second users.
blog · samcurry.net
Reading ASP secrets for $17,000
Turning local file disclosure on an ASP.NET app into a $17,000 bounty: reading download.aspx source, bypassing the two-dot traversal block, and hunting server-side secrets with the widened access.
blog · samcurry.net
Exploiting Directory Traversal to View Customer Credit Card Information on Yahoo's Small Business Platform
A directory traversal on Yahoo's small business platform let attackers view customer credit-card data by brute-forcing a predictable service ID; the writeup covers stack recon and the data-leak path.
blog · bughunters.google.com
Breaking into Google's GFile for $100k
This post details an attack on Google’s internal APIs, bypassing authorization to exploit the GFile library to gain access to internal filesystems and storage.
blog · bishopfox.com
How a $20 Smart Device Gave Me Access to Your Home
The story behind the YoLink research: an authorization bypass lets attackers control other users' devices, Wi-Fi credentials travel in cleartext, and long-lived tokens permit persistent hub access.
Back