tl;dr

• Upload log configuration file and exploit path traversal to gain RCE

tl;dr

• Create a note with meta redirect tag to get callback.
• Leak the flag using search functionality.

tl;dr

• Use DNS Rebinding attack to read flag from /flag endpoint.

tl;dr

• XSS using DOM Clobbering
• <a id="showInfos"></a><a id="SETTINGS" name=check data-timezone="aaa" data-location="eval(window.name)"><a id="SETTINGS" name="x">
• Bypass CSRF protection to execute XSS and read flag.

tl;dr

• Leak admin’s hash using wildcard target origin in postMessage or by calculating sha256('').
• Create an XSS payload to read /api/flag and send it to attacker server.