Hacksplaining Log in

Want everyone on your software team to learn this? Free 14-day trial.

Train my team

Unfortunately, the raw file name is used in the download URL, so an attacker can abuse the menu parameter to "climb out" of the directory that holds the menu PDFs.

www.foodle.com/menus?menu=arachnoburger.pdf
The Foodle logo
F · O · O · D · L · E
Menus for all your favorite restaurants
Arachnoburger

Authentic artisanal spider-meat burgers, freshly shaved.

Kimchi Vending Machine

A vending machine that just serves Kimchi.

The Daily Grind

Freshly roast espressos served by glassy-eyed hipsters who would clearly prefer to be somewhere else right now.

arachnoburger.pdf
1.2 MB
Done