POC by W3shi (HackerOne)