Everything about Lemmy; bugs, gripes, praises, and advocacy.
For discussion about the lemmy.ml instance, go to !meta@lemmy.ml.
Ah. So Lemmy with version 0.19.4+ allows users to set a custom thumbnail URL for a post, which can be set to pretty much anything resembling a valid link, especially a link to another image in the local pictrs db and trigger a deletion of both when a minimum age check is passed.
Also this:
Except that the field allows some funny URLs e.g.
https://t.t/;';'%22;...[:%3C%3E?]%27;%20yaba%20daba%20doo, if this is an issue too is not confirmed
On point summary.
And I was just about to write that I have confirmed SQLi is not possible to find out I have missed something that might in-turn make it possible! holy hell back to drawing board
Yikes. Thanks for putting in the works and sharing your findings to you and @Nothing4You@programming.dev.
I'm really curious how someone can exploit a script that is meant to be running locally with no external facing interface
Post edited with link to more information.
thanks