---
id: 6578
title: "Exploiting Directory Traversal to View Customer Credit Card Information on Yahoo's Small Business Platform"
source_domain: samcurry.net
source_url: "https://samcurry.net/exploiting-directory-traversal-on-a-yahoo-acquisition"
published_at: "2017-11-10T00:00:00Z"
tags: ["bug-bounty", "web-security", "pii", "directory-traversal", "yahoo", "credit-card"]
phying_url: "https://phying.com/item/6578"
lang: en
---

# Exploiting Directory Traversal to View Customer Credit Card Information on Yahoo's Small Business Platform

## Summary

A directory traversal on Yahoo's small business platform let attackers view customer credit-card data by brute-forcing a predictable service ID; the writeup covers stack recon and the data-leak path.

## Intelligence Metadata

- **Sources:** samcurry.net
- **Published:** 2017-11-10T00:00:00Z
- **Original:** https://samcurry.net/exploiting-directory-traversal-on-a-yahoo-acquisition
- **Phying News:** https://phying.com/item/6578