oolongeya@gmail.com
DreamHackRed teaming and penetration testing in WEB/APP environments.
oolongeya
Offensive Security Engineer
Performed red teaming and penetration testing at a financial company in South Korea. Began participating in CTF competitions in 2022 and bug bounty programs in 2026.
•Experience
I have gained expertise in establishing and evaluating end-to-end information security processes within given environments.
•Vulnerability Reports
- An unauthenticated debug endpoint in Dgraph Alpha exposes the full process command line, including the configured admin token
- pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev97, the /json/package_order, /json/link_order, and /json/abort_link WebUI JSON endpoints enforce weaker permissions than the core API methods they invoke. This allows authenticated low-privileged users to execute MODIFY operations that should be denied by pyLoad's own permission model.
- already logged-in user can keep old (revoked) privileges until logout/session expiry, enabling continued privileged actions.
- The plugin does not properly handle batch requests, which could allow unauthenticated users to make a logged in admin call non store/WC REST endpoints, and create arbitrary admin users via a CSRF attack for example.
- A low-privileged user can submit arbitrary post IDs through Content AI bulk actions and trigger unauthorized processing of protected content.
- unauthenticated user can reliably trigger a server exception.
- Insufficient authorization checks in the term path can allow unauthorized post title modification under ID-collision conditions.
- A low-privileged user can pass permission checks with their own object ID and overwrite metadata rows of other users by targeting foreign meta IDs.
- A low-privileged contributor can inject attacker-controlled URLs into Kubio block attributes to trigger server-side fetches and save responses into public uploads. This enables SSRF-like access to internal resources and unauthorized data exposure despite normal media upload restrictions.
- Subscriber can inject SQL (time-based blind confirmed), which can be used to extract sensitive database data and potentially lead to privilege escalation.
- By taking over admin privileges, restricted features can be controlled.
- By taking over admin privileges, restricted features can be controlled.
•Bug Bounty
- Private
- Private
- A malicious phishing link under a PayPal domain can be generated and redirect users to a malicious site when clicked.
- The plugin does not properly handle batch requests, which could allow unauthenticated users to make a logged in admin call non store/WC REST endpoints, and create arbitrary admin users via a CSRF attack for example.
- Some paywalled episodes returned media URLs and file IDs without authentication, while other PAYMENT_REQUIRED episodes were properly blocked.
- CSRF is possible via a nonce-bypass request.
- A low-privileged user can queue unauthorized bulk processing on protected posts through Content AI bulk actions.
- Authorization weakness in updateMetaBulk can lead to unauthorized post title updates in specific ID-collision scenarios.
- An object-level authorization mismatch in updateSchemas allows unauthorized overwrite of foreign post metadata.