Other nomination

There's an OAK TREE in my blog!?!?!

Billy Rios

Google Docs' publish-to-your-blog feature POSTs to /MiscCommands with a docID the server never checked against the caller. Swapping in another document's docID made Google send that document to the attacker's own WordPress blog; Rios demonstrates it on Google's Oak Tree View demo doc. Google fixed it and raised DocID entropy.

Record

Researcher

Billy Rios

In the archive

• Nominated for the 2007 Top 10 Web Hacking Techniques

Tags

• idor
• auth-bypass
• info-leak
• wordpress
• case-study
• owasp-a01-2021

This page is the archive's own catalogue record. The research is the work of Billy Rios, first published at the original source. Preserved copies are kept so the citation survives its host.