Recent Posts
RCE on Pocketbase possible?
2JeWbY
No.3172
Yaaron I am doing vulnerability testing for a product and I got one endpoint on which I manage to get read/write access by grepping access token via curl. I tried .py and .php code for admin level execution but I failed.
Pocketbase runs on go and I am a retard who can't write go for RCE (remote code execution). I don't know if go will work in RCE. So what should I do to get admin = "true" so that I can use pb CLI with admin token as payload , once there I can try to execute shell commands and possibly create ssh keys
or maybe I should give up :(
sqrvwV
No.3190
Maybe it is
wAKyen
No.3192
>>3172(OP)
You got read write perms ? Report it,
Wtf do you mean by .py and php code there's no interpreted runtime in go where you can inject and execute arbitrary code.
Cot8bx
No.3365
>>3172(OP)
what even are you talking about? R/W by "grep"ing access token? what?
