News for hackers. Stuff that matters.

A comment on Inside PostHog: SSRF, ClickHouse SQL Escape and Default Postgres Creds to RCE.

Re:Inside PostHog: SSRF, ClickHouse SQL Escape and Default P... by lkt on Wednesday December 17, 2025 @05:18PM (#46306352)
Out of interest, how much does ZDI pay for a bug like this?
[ Parent | on HN ]
Re:Inside PostHog: SSRF, ClickHouse SQL Escape and Default P... by rs_rs_rs_rs_rs on Thursday December 18, 2025 @01:33AM (#46309537)
They probably don't accept something like this. Not that many Posthog self-hosted instances out there...
[ Parent | on HN ]
Re:Inside PostHog: SSRF, ClickHouse SQL Escape and Default P... by lkt on Thursday December 18, 2025 @01:56AM (#46309638)
That's what I thought too, but the article says it was submitted to ZDI and they handled the communication with Posthog
[ Parent | on HN ]
Re:Inside PostHog: SSRF, ClickHouse SQL Escape and Default P... by wtfse on Thursday December 18, 2025 @08:45AM (#46312549)
All of these vulnerabilities accepted by ZDI.Feel free to search the following codes. ZDI-CAN-25351. ZDI-CAN-25352. ZDI-CAN-25350. ZDI-CAN-25358.
[ Parent | on HN ]