Title: tl;dr: How we got $10.000. We were able to upload an XML file to Google. The XML parser was vulnerable to XXE. We got full read access to their production servers, including the &#x2F;etc&#x2F;passwd.
Upvote: