Bugbounty on MOZA

Unauthenticated SQL Injection via WordPress 0day — Mars (Royal Canin)

Sat, 18 Jul 2026 00:00:00 +0000

Summary

Detail	Value
Target	Mars (Royal Canin)
Weakness	Authentication Bypass → SQL Injection (CVE-2026-63030 / CVE-2026-60137)
Severity	Critical
Status	Resolved
Platform	HackerOne

The Story

I had Mars in my scope for a while. Subdomains were already enumerated, endpoints mapped — the usual recon groundwork that sits in your notes waiting for the right moment.

That moment came when wp2shell dropped.

A 0day targeting WordPress core — specifically a batch-route confusion flaw in WP_REST_Server::serve_batch_request_v1() combined with a SQL injection in the WP_Query class via the author__not_in parameter. An unauthenticated attacker could bypass authentication through the REST API batch endpoint and inject SQL queries directly into the database.

Unauthenticated Admin API Access via HTTP Verb Tampering

Tue, 03 Feb 2026 00:00:00 +0000

Summary

Detail	Value
Target	REACTED
Weakness	Improper Authorization + HTTP Verb Tampering
Severity	Critical
Reports	2 related findings
Status	Resolved
Platform	HackerOne

The Story

It started with the Wayback Machine.

While mapping a REACTED application, I threw the wildcard scope into the Web Archive CDX API:

https://web.archive.org/cdx/search/cdx?url=*.example.com&output=text&fl=original&collapse=urlkey

Among the archived URLs, a few interesting endpoints caught my eye:

/Dtts3s/winners
/Dtts3s/valid
/Dtts3s/list

These looked like admin panel routes for managing a promotional campaign. I hit them with GET requests — nothing. The frontend redirected or returned empty responses. The UI routes appeared protected.

AWS Firehose Credentials Fix Bypass

Mon, 12 Jan 2026 00:00:00 +0000

Summary

Detail	Value
Target	REACTED
Weakness	Information Disclosure — Fix Bypass
Severity	Medium
Status	Triaged
Platform	HackerOne

The Story

I was reading through disclosed HackerOne reports when I came across a publicly disclosed vulnerability about exposed AWS Firehose credentials on a DoD system. The report had been marked “Resolved” back in February 2025.

But resolved doesn’t always mean fixed properly.

I grabbed the credentials from the original disclosure and tested them. They still worked.

HTML Injection in Email Notifications via Seller Form

Thu, 13 Nov 2025 00:00:00 +0000

Summary

Detail	Value
Target	Car marketplace platform
Weakness	HTML Injection in Email
Status	Triaged
Platform	HackerOne

The Story

I found this one while testing a car seller form on a marketplace platform. The First Name field caught my attention — when I submitted HTML tags, they got rendered in the email notification I received.

At first, I didn’t report it. HTML injection in emails often gets closed as informative, and I didn’t want to waste anyone’s time.

Stored XSS via SVG Upload

Mon, 04 Aug 2025 00:00:00 +0000

Summary

Detail	Value
Target	Web automation platform
Weakness	Stored XSS via SVG Upload
Severity	Medium
Status	Resolved
Platform	HackerOne

The Story

After finding a CSRF on the same platform’s editor, I kept digging. I started collecting all possible file upload forms to test for upload-based vulnerabilities.

The platform’s embed interface had a file input that caught my attention. Files uploaded through it were stored and served via a CDN subdomain. I crafted a simple SVG with a JavaScript payload and uploaded it.

Multiple CSRF + IDOR — Car Marketplace Platform

Thu, 17 Jul 2025 00:00:00 +0000

Summary

Detail	Value
Target	Car marketplace platform
Weakness	CSRF + IDOR
Reports	2 separate findings
Status	Triaged
Platform	HackerOne

The Story

While testing a car marketplace platform, I noticed the endpoints for managing car listings had no CSRF protection at all. No tokens, no SameSite cookies, no origin validation — nothing.

I found two separate attack vectors, both exploitable with a simple HTML page.

Vulnerability 1 — Modify Other Users’ Car Listings

This one was a CSRF combined with an IDOR. The endpoint for editing car listings accepted a carId parameter, but never verified that the authenticated user actually owned that car.

CSRF — Missing Protection on Editor API Endpoint

Mon, 14 Jul 2025 00:00:00 +0000

Summary

Detail	Value
Target	Web application editor (`/editor/*`)
Weakness	Cross-Site Request Forgery (CSRF)
Severity	High
Status	Resolved
Platform	HackerOne
Reported	2025-07-14
Resolved	2025-09-10

Overview

A state-changing API endpoint under the application’s editor interface had no CSRF protection at all. This allowed an attacker to craft a simple HTML page that, when visited by a logged-in user, would silently create or modify data in the victim’s account without any interaction.

The Vulnerability

The endpoint:

Premium Feature Bypass via PATCH Request

Fri, 13 Jun 2025 00:00:00 +0000

Summary

Detail	Value
Target	Roblox
Weakness	Improper Access Control
Severity	Low (adjusted by vendor)
Status	Resolved
Platform	HackerOne

The Story

I was editing one of my server listings on the platform when I intercepted the PATCH request in Burp Suite. Something caught my eye — the request body already contained an imageUrls parameter, sitting there empty alongside other fields:

data=test&imageUrls=[]&...

According to the UI, uploading images was “Premium Only” — the frontend showed a clear message: “Uploading images is only available to premium servers.”

Token Not Invalidated After Account Deletion

Sat, 07 Jun 2025 00:00:00 +0000

Summary

Detail	Value
Target	Roblox
Weakness	Improper Authentication
Severity	Low (adjusted by vendor)
Status	Resolved
Platform	HackerOne

The Story

I was reading through HackerOne reports when I came across one about testing whether platform functions still work after you delete your account. Simple concept, but nobody was testing it.

So I tried it on a community platform.

I created an account, set up a server, and used Burp Suite to capture a PATCH /v4/communities/{id} request. Then I deleted my account via DELETE /v4/users/@me, waited some time, and replayed the saved PATCH request.