person

Santosh Kumar Puppala

Security researcher who found and reported the unguarded address-book read under coordinated disclosure and published the write-up on dev.to.

Current clusters

build1 distinct publisher

GOautodial runs an agent's logout parameter through /bin/sh

The goPhone value is escaped for SQL, then dropped into an exec() string that PHP runs through /bin/sh. Any active agent can trigger the logout call, and on a production box the injected command runs under sudo.

Publishers:dev.to

Reality

Evidence60
Adoption28
Hype gap+14
Incentives58

build1 distinct publisher

A second ApiResource block left CoopCycle's address-book read outside the tenant check

API Platform checks authorization per operation, so the guard on the POST told a reviewer nothing about the GET declared on a different entity, and the provider behind that GET trusted the store id in the path.

Publishers:dev.to

Reality

Evidence60
Adoption25