0day Hunting the Day After xAI Open-Sourced grok-build (Part 4): ptyctl Test Server's Zero-Auth CORS and Cross-Origin RCE
0day (4) I found the day after xAI open-sourced grok-build.
Research Archive
Vulnerability Analysis
Browse entries by research type, time, topic, and threat domain. This page behaves more like an archive than a feed.
2026
0day Hunting the Day After xAI Open-Sourced grok-build (Part 3): Grok-Build-CLI's folder-trust Blind Spot and the Zero-Prompt RCE
0day (3) I found the day after xAI open-sourced grok-build.
0day Hunting the Day After xAI Open-Sourced grok-build (Part 1): The cargo check RCE Chain in Grok-Build-CLI
0day (1) I found the day after xAI open-sourced grok-build.
0day Hunting the Day After xAI Open-Sourced grok-build (Part 2): The bypassPermissions RCE in Grok-Build-CLI and Claude Code CLI
0day (2) I found the day after xAI open-sourced grok-build.
2025
CVE-2025-53770 SharePoint WebPart Injection Deserialization RCE: Active Exploitation Before Patch Day
CVE-2025-53770 is a Microsoft SharePoint Server (on-prem) WebPart injection + .NET deserialization RCE. Microsoft has confirmed in-the-wild exploitation; attackers inject malicious WebPart payload via unauthenticated POST /_layouts/15/ToolPane.aspx, triggering .NET deserialization gadget chain to take down the SharePoint server.
CVE-2025-44148 MailEnable Webmail Reflected XSS: Unsanitized state Parameter in failure.aspx
CVE-2025-44148 is a reflected XSS in MailEnable Webmail before version 10, CVSS 6.1. Attackers craft a state parameter containing malicious JavaScript and visit /Mondo/lang/sys/Failure.aspx; MailEnable writes it directly into HTML without sanitization, triggering the browser to execute arbitrary JS — stealing sessions and launching phishing.
CVE-2025-32433 Erlang/OTP SSH Pre-Auth RCE: Session Channel Eats Erlang Code
CVE-2025-32433 is a pre-authentication RCE in the Erlang/OTP SSH server, CVSS 10.0. After a standard SSH handshake, attackers send Erlang expressions (not normal shell commands) on the session channel — OTP SSH hands the string to the Erlang VM to evaluate before authentication, achieving unauthenticated RCE.
CVE-2025-55184 React Server Components Infinite Loop DoS: A Single Payload Locks CPU
CVE-2025-55184 is a denial-of-service in React Server Components (RSC), CVSS 7.5. Attackers send a carefully crafted HTTP request to the Server Function endpoint, triggering the RSC deserialization flow into an infinite loop, consuming 100% CPU for DoS, affecting React 19.0.0 to 19.2.1.
Explore CMS v1.1 Reflected XSS: How a Community CMS's UserID Field Became the Attack Entry Point
The user/login.php and admin/login.php endpoints in Explore CMS v1.1 perform zero sanitization or validation on the UserID field. An attacker can trigger reflected XSS with a simple
CVE-2025-32395 Vite Dev Server Path Traversal: # Character Bypass of server.fs.deny
CVE-2025-32395 is a path traversal in Vite Dev Server, CVSS 5.9. Attackers use the # character in URLs to bypass the server.fs.deny middleware; combined with /../, the path escapes the project directory to read arbitrary files.
CVE-2025-4123 Grafana Full-Read SSRF + Account Takeover: Open Redirect + CSPT + Client-Side Traversal Chain
CVE-2025-4123 is a Grafana full-read SSRF + account takeover chain, CVSS 7.6. Attackers use staticHandler's Open Redirect + render endpoint's SSRF + plugin-app explore's CSPT to poison attacker-controlled JSON into the client, hijack module loading, and achieve Account Takeover.
CVE-2025-52287 WSUS Deserialization to RCE: Four-Stage Exploitation via SimpleAuth Cookie Chain
CVE-2025-52287 is a Windows Server Update Services deserialization RCE, CVSS 9.8. Attackers use a 4-stage chain (obtain ID → grab cookie → use cookie to trigger SimpleAuth → inject deserialization payload) to gain RCE on the WSUS server, controlling the enterprise patch distribution center.
CVE-2025-56386 Notepad++ DLL Hijacking: v8.8.3 DLL Search Order and CWD Fatal Combination
CVE-2025-56386 is a DLL hijacking vulnerability in Notepad++ v8.8.3, CVSS 8.4. Notepad++ follows Windows' default DLL search order (including the current working directory) when loading DLLs, without using SetDefaultDllDirectories + LOAD_LIBRARY_SEARCH to limit safe paths — attackers place a same-named DLL in the CWD where the user opens a malicious document, and Notepad++ loads the malicious DLL to gain RCE.
CVE-2025-30406 CentreStack Deserialization to RCE: Hard-coded Machine Key + ASP.NET ViewState Exploitation
CVE-2025-30406 is a hard-coded Machine Key vulnerability in CentreStack / Triofox before 16.1.10296.56315, CVSS 9.8. Attackers use ysoserial to generate a malicious ViewState payload, sign it with the hard-coded validation key, and send it to an ASP.NET endpoint to trigger deserialization and execute arbitrary commands.
ReachMe.io Vulnerability: Saying Hi to CZ on a Budget
ReachMe.io is a paid messaging platform on BNB Chain where messaging CZ costs 1 BNB. The SlowMist Security Team discovered an on-chain/off-chain price validation inconsistency that allowed bypassing the 1 BNB fee — sending messages to any KOL for as little as 0.001 BNB. The vulnerability was reproduced in about 10 minutes and the project team fixed it immediately.
CVE-2025-29927 Next.js Authentication Bypass: x-middleware-subrequest Recursion Depth Evasion
CVE-2025-29927 is a Next.js middleware authorization bypass, CVSS 9.1. Attackers craft an x-middleware-subrequest header with recursion depth ≥ MAX_RECURSION_DEPTH (5) so Next.js treats the request as an internal subrequest and skips the entire middleware chain — unauthenticated access to protected pages.
CVE-2025-24813 Apache Tomcat Path Equivalence + Persistent Session RCE: Partial PUT and Default Servlet Converging
CVE-2025-24813 is a path-equivalence plus persistent-session RCE in Apache Tomcat, CVSS 9.8. The attacker uses the Content-Range partial PUT to write to .internal in Tomcat's work directory, then triggers default servlet to read the file as JSP for compilation and execution, achieving remote RCE.
CVE-2025-27415 Nuxt.js Cache Poisoning DoS: Newline Bypass on Route Regex
CVE-2025-27415 is a Cache Poisoning denial-of-service in Nuxt.js, CVSS 7.5. The attacker uses newline plus space combinations in URLs to bypass the route regex, triggering Nitro route matching with an empty cache key, causing the cache to grow without bound and exhausting memory for DoS.
CVE-2025-5777 Citrix NetScaler Memory Overread: From <InitialValue> Reflection to Pre-Auth Memory Leak
CVE-2025-5777 is a memory overread vulnerability in Citrix NetScaler, CVSS 7.5. NetScaler accepts unauthenticated requests in VPN / ICA Proxy / CVPN / RDP Proxy / AAA modes, and the field in the login response XML reflects user input. An attacker can craft a payload that triggers memory overread, leaking NetScaler process memory contents including session tokens, configuration, and credentials.
CVE-2025-21756 Linux Kernel vsock UAF: Shortest Path from Socket Subsystem to Root
CVE-2025-21756 is a Use-After-Free in the Linux kernel vsock subsystem, CVSS 7.8. The attacker triggers an inconsistency between sk and vsk references in vsock_diag_dump via AF_VSOCK sockets, escapes to a kernel ROP chain, and escalates from an unprivileged user to root.
CVE-2024-12877 GiveWP PHP Object Injection: When unserialize Meets Magic Methods
CVE-2024-12877 is a PHP Object Injection in GiveWP before 3.19.3, CVSS 7.5. Attackers craft a malicious serialized object that triggers __wakeup / __destruct to execute arbitrary code; even the improved is_serialized regex cannot save an application that still calls unserialize on user input.
CVE-2025-0133 GlobalProtect Gateway Reflected XSS: credential theft at the VPN portal
CVE-2025-0133 is a reflected XSS in Palo Alto Networks PAN-OS GlobalProtect Gateway and Portal, CVSS 6.9 (CVSS v4.0). An attacker crafts a malicious URL to inject JavaScript into the VPN login page, stealing user credentials or hijacking sessions.
CVE-2025-11001 7-Zip ZIP Parsing Directory Traversal to RCE: Symlink Converging With the Extraction Path
CVE-2025-11001 is a directory-traversal flaw in 7-Zip's ZIP parser that mishandles symlinks, CVSS 7.8. Attackers craft a malicious ZIP with a symlink pointing to a system-sensitive path; when the victim extracts, subsequent files are written through the symlink to an arbitrary location, providing a pivot to RCE.
CVE-2025-21298 Windows OLE RCE: Plus-Offset Triggering Use-After-Free in CStdStubBuffer
CVE-2025-21298 is a Use-After-Free in the Windows OLE component, CVSS 9.8. The attacker crafts a malicious RTF document that triggers an integer overflow via plus-offset on the ole32!CStdStubBuffer_Disconnect path, causing double free and UAF, which combined with COPE delivers RCE.
CVE-2024-12877 GiveWP PHP Object Injection: unserialize vs. Regex, a Futile Fight
CVE-2024-12877 is a PHP object injection flaw in GiveWP 3.19.2 and below, CVSS 7.5. The plugin validates serialized input with regex, but as long as unserialize() runs on user input, regex is decoration — attackers bypass it and trigger __wakeup() magic methods to reach RCE.
CVE-2025-0108 PAN-OS Authentication Bypass: Palo Alto firewall compromised again
CVE-2025-0108 is an authentication bypass in Palo Alto Networks PAN-OS, CVSS 9.8. An attacker bypasses the management interface authentication via a specific path and accesses management functions directly. Combined with CVE-2024-3400 or similar command injection, it enables unauthenticated RCE.
CVE-2025-0282 Ivanti Connect Secure Pre-Auth Stack Overflow RCE: Buffer Overflow on the VPN Gateway
CVE-2025-0282 is a pre-authentication stack-buffer-overflow RCE disclosed in Ivanti Connect Secure in January 2025, CVSS 9.0. Attackers send overlong strings to the /dana-na/auth/url_default/welcome.cgi endpoint, trigger a stack overflow, overwrite the return address with system(), and execute arbitrary commands on the VPN gateway without credentials.
2024
CVE-2024-10793 WP Activity Log: Stored XSS to RCE in the Audit Page
CVE-2024-10793 is a stored XSS flaw in WP Activity Log 5.2.1 and below, CVSS 7.2. Attackers POST unfiltered log entries via admin-ajax.php; when an admin views the log page the XSS fires, steals a nonce, and uploads a PHP webshell to reach RCE. The audit page treats the log database as a trusted render plane, and the write path accepts HTML fragments from any authenticated subscriber. The exploit follows a simple chain: insert payload, wait for admin to view log, run injected script under the admin origin, abuse WordPress nonce to authorize a plugin upload, drop a PHP shell. The audit trail is exactly where least-privilege XSS is most expensive.
CVE-2024-10793 WP Activity Log Stored XSS to RCE: Unsanitized Writes to the Admin Render Plane
CVE-2024-10793 is a stored XSS flaw in WP Activity Log before 5.2.1, CVSS 7.2. An attacker injects unsanitized log entries via admin-ajax.php; when an admin opens the activity log panel, the XSS fires and chains nonce theft with plugin upload to drop a PHP Webshell, escalating anonymous XSS to RCE. The render plane for the activity log trusts whatever the write path hands over, and the write path accepts HTML fragments from any subscriber-level user. The fix mirrors the same pattern: sanitize at the write path, escape at the render path, and never mix user-supplied data with the trusted admin context. The chain also reveals why low-privilege XSS still matters: the admin browser is the most privileged context on the site.
Three npm Vulnerabilities in lunary-ai: SAML XSS, IDOR, and Privilege Escalation on the Same Trust Chain
lunary-ai/lunary versions before 1.6.7 carry three CVEs in one release line: CVE-2024-10273 Stored XSS in SAML metadata, CVE-2024-11137 IDOR in the PATCH /v1/runs/:id/score endpoint, and CVE-2025-0281 privilege escalation in PATCH /v1/models/:id. Each one lives in a different surface area, yet every root cause points to the same consistency gap: the platform treats authentication as equivalent to authorization. The SAML parser keeps attacker-controlled script nodes; the score endpoint only checks the project's owner, ignoring whether the requester is the project itself; the model endpoint omits a project-id check. The fix is twofold: sanitize the SAML metadata through an allowlist parser, and centralize the project membership check. The lesson generalizes: every authenticated route must answer both 'who are you' and 'what can you touch'.
CVE-2024-52875 Kerio Control CRLF Injection to 1-click RCE: silent firewall takeover
CVE-2024-52875 is a CRLF injection in Kerio Control 9.2.5 to 9.4.5, CVSS 8.8. An attacker crafts a request with CRLF characters to inject HTTP headers, and with social engineering to make an admin click the link, achieves 1-click RCE and full firewall control. CRLF characters in user input should never survive into a header line; the firewall's admin web interface forgets that rule, and a redirect parameter becomes the entry point. The exploit chain runs response splitting, cookie injection, then a script body that calls the firewall's own API. The lesson is that 1-click does not mean low impact: a single admin click on a phishing message compromises the entire gateway.
CVE-2024-46982 Next.js Cache Poisoning: silent hijacking of non-dynamic SSR pages
CVE-2024-46982 is a cache poisoning vulnerability in Next.js 13.5.1 to 14.2.9.2, CVSS 7.5. Non-dynamic SSR pages do not isolate user-specific data at the cache layer. An attacker poisons the cache by injecting a malicious Host header, and subsequent users receive the poisoned response, leading to XSS or credential theft. The cache key omits the Host header, so a poisoned entry stays valid until eviction. The fix in 14.2.10 requires explicit opt-out of full-route cache for pages with redirect logic. The broader lesson: every cache key must include any value that flows into the rendered response, especially headers that the server itself uses to construct URLs.
CVE-2024-9264 Grafana DuckDB SQLi to RCE: authenticated database piercing
CVE-2024-9264 is a post-authentication DuckDB SQL injection in Grafana OSS/Enterprise 11.0.0-11.2.1, CVSS 8.8. An authenticated user can inject DuckDB commands to read arbitrary files, and on specific versions (with the duckdb binary installed), execute arbitrary system commands, achieving RCE. The SQL interface forwards raw expressions to the DuckDB engine without allowlist, so attacker-controlled DuckDB functions like read_csv() and load_extension() become the bridge from query box to filesystem. The lesson is that any data source that runs native commands is a privilege boundary, and the SQL editor itself needs the same isolation as a system shell.
CVE-2024-5420 SEH UTN Server XSS: cross-site scripting in USB device management interface
CVE-2024-5420 is an XSS vulnerability in SEH Computertechnik UTNserver Pro/ProMAX/INU-100 prior to 20.1.22, CVSS 8.3. An attacker crafts a malicious URL to inject JavaScript into the UTN Server admin web interface, stealing admin sessions or performing other malicious actions. The management web interface renders user-controlled parameters without escaping, so a single crafted link can pivot the admin session. The interesting twist: this device bridges USB over the network for printers and dongles, so the XSS also yields access to the USB-over-IP control plane, not just the web shell.
CVE-2024-41992 Arcadyan FMIMG51AX000J RCE: ISP router supply chain bug
CVE-2024-41992 is a remote code execution vulnerability in the Arcadyan FMIMG51AX000J router firmware (used in WiFi Alliance EasyMesh certified devices), CVSS 9.8. An attacker triggers unauthenticated RCE through the web interface, impacting a large number of ISP-deployed home gateways globally. The firmware ships a hidden diagnostic page that calls system() with attacker-controlled parameters; that diagnostic path is reachable from the LAN management interface without authentication. Because the same firmware is re-branded by many ISPs, the blast radius is the entire supply chain: one firmware bug, hundreds of carriers, millions of household gateways.
CVE-2024-27956 WP Automatic SQL Injection: from 9.9 plugin bug to admin account takeover
CVE-2024-27956 is a SQL injection in the WordPress valvePress/Automatic plugin, CVSS 9.9. An attacker bypasses authentication with %0a in the auth parameter, then injects SQL through the q parameter to dump the entire database, finally creating an eviladmin account and popping a shell. The auth check splits the input on the newline character but the database connection accepts %0a as a line terminator inside a string literal, so an attacker appends a second query that the database happily executes. The fix is to use parameter binding at the auth check as well. The lesson: any input that crosses a line-ending boundary deserves parameterization, not just text fields.
CVE-2024-38475 Apache HTTPD mod_rewrite path traversal: from BlackHat 2024 to RCE
CVE-2024-38475 is a mod_rewrite path traversal in Apache HTTPD prior to 2.4.59, CVSS 9.1, disclosed by Orange Tsai at BlackHat 2024. An attacker crafts a special request to bypass mod_rewrite rule mapping, access files outside the web root, and under specific configurations, achieve RCE. The flaw is in the substitution target: a malformed input lets the rule's replacement be re-interpreted, so a path meant to land in the docroot lands in the parent directory. With RewriteRule flags that hand the request off to a CGI handler, that out-of-root file becomes a server-side script and turns into RCE.
CVE-2024-40725 Apache HTTPD HTTP request smuggling: Content-Length parsing inconsistency
CVE-2024-40725 is an HTTP request smuggling vulnerability in Apache HTTPD prior to 2.4.61, CVSS 5.3. An attacker exploits the inconsistency between how Apache handles Content-Length with special characters and how the proxy/backend interprets the same request, smuggling a second request through. The CL.0 variant: Apache reads the body using chunked transfer and disregards the Content-Length header, while the backend trusts the same Content-Length. The fix is to make Apache normalize or reject the conflicting header pair. Smuggling is a protocol boundary flaw: every hop in the chain has its own parser, and any disagreement becomes a smuggling channel.
CVE-2024-4956 Sonatype Nexus OSS Path Traversal: from artifact repository to arbitrary file read
CVE-2024-4956 is a path traversal in Sonatype Nexus Repository OSS prior to 3.68.1, CVSS 7.5. An attacker crafts a special URL to bypass path restrictions and read arbitrary files on the server (such as /etc/passwd, configuration files, keys) without authentication. The vulnerable endpoint is the static-asset handler, which concatenates a base directory with the request path and serves the result. The traversal lands on /etc/passwd first, then escalates to /opt/sonatype/nexus/etc/nexus.properties, which leaks the admin password hash. The lesson is that an artifact server is also a file server, and any file-serving endpoint must normalize and confine the path to a known allowlist.
CVE-2024-38094 Microsoft SharePoint RCE: unauthenticated remote code execution
CVE-2024-38094 is a remote code execution vulnerability in Microsoft SharePoint Server, CVSS 6.3, affecting many SharePoint Server deployments. An attacker bypasses authentication through a crafted request and executes arbitrary code on the server, gaining access to all SharePoint content. The vulnerable handler trusts the request path before authentication, then evaluates it as a server-side template, so the unauthenticated call ends up compiling user input as .NET code. The fix in the July 2024 patch validates the route through the authentication pipeline. The lesson is that any code-evaluation endpoint needs to live behind the same auth check as the rest of the surface, not in front of it.
CVE-2023-7137 Client Details System 1.0 SQL Injection: classic boolean-based bug in uemail
CVE-2023-7137 is a SQL injection in Client Details System 1.0, CVSS 8.8, located in the login endpoint's uemail parameter. An attacker uses classic OR 1=1 payloads to bypass authentication, then hands the request to SQLmap to dump the entire database. The root cause is missing input sanitization in the login path. The boolean-based variant reveals the vulnerability through differential responses: a true condition logs the attacker in, a false condition rejects. Even legacy PHP applications still ship with string-concatenated SQL, and the login endpoint is the worst place for that mistake because it gives the attacker a free boolean oracle on every account.
CVE-2024-7954 Prote_plume Plugin RCE: from open-source security tool to unauthenticated RCE
CVE-2024-7954 is an RCE in the Prote_plume plugin, CVSS 9.8. An attacker triggers code injection via an unauthenticated request, executing arbitrary commands on the server. The plugin is designed as a security scanning tool but itself contains a critical security flaw. The irony is sharp: a tool meant to defend the codebase ships with a backdoor of its own. The unauthenticated endpoint accepts a remote template parameter and renders it through PHP's eval()-equivalent, so an attacker can hand-craft a request that the server then compiles and runs. The fix removes the eval path entirely and confines the scanner to read-only checks. The lesson generalizes: any tool that calls into user-controllable code is itself an attack surface.
CVE-2023-50164 Apache Struts File Upload Path RCE: A Classic Bug in a Classic Framework
CVE-2023-50164 is a file upload path manipulation RCE in Apache Struts 2.5.0-2.5.33 and 6.0.0-6.3.0.2, CVSS 9.8. Attackers manipulate file upload parameters to control the upload path and combine it with Struts' OGNL injection to achieve unauthenticated RCE. The Struts file upload handler passes the filename through the OGNL expression engine, so a crafted filename is evaluated as a server-side expression. The attacker chains this with a path-traversal in the upload destination to land a server-side script in the webroot, then triggers the upload handler to evaluate it. The framework is famous for OGNL, and this CVE is the reminder that any expression engine in a request path is a remote shell.
CVE-2024-24919 Check Point VPN Arbitrary File Read: The Admin Plane on the Public Internet
CVE-2024-24919 is an arbitrary file read flaw in Check Point Security Gateway's SSL Network Extender, CVSS 8.6. An unauthenticated attacker POSTs to /clients/MyCRL to read /etc/passwd; combined with Censys dorks and nuclei templates, the exposure is harvested at internet scale. The endpoint is a CRL fetcher that returns the contents of a path-attacker-controlled file; the path filter trusts everything after the prefix, so the response leaks any file the gateway process can read. The lesson is that an admin-facing endpoint that accepts user input and returns file contents is a file read primitive; the only safe design is a strict allowlist of paths the system itself owns.
CVE-2024-32002 Git submodule + symlink RCE: arbitrary code execution via git clone –recursive
CVE-2024-32002 is a Git RCE, CVSS 9.0, triggered by git clone –recursive. The attacker prepares a malicious repository: the submodule contains a malicious post-checkout hook plus a symlink pointing to the .git directory. When the victim clones it, Git executes the hook and achieves RCE. The attack abuses two cooperating features: submodules run their hooks on the parent repository's behalf, and case-insensitive filesystems on macOS let a symlink named .GIT point into the parent. The hook is then activated during the recursive checkout phase. The fix tightens submodule hook execution rules and the symlink handling. The lesson: a clone is not a passive read; the result it produces is a running system.
CVE-2023-46943 JWT Token Verification Bypass: from missing signature checks to identity spoofing
CVE-2023-46943 is a misconfiguration in JWT token verification, CVSS 9.1. It affects applications that use third-party JWT libraries without enforcing signature checks. The attacker changes the alg field in the JWT header to none or substitutes the signing key to bypass verification and impersonate any user. The flaw is a misconfiguration, not a library bug: most JWT libraries accept alg=none when the developer does not explicitly reject it, and the verification middleware in this project allowed the same. The lesson is that JWT verification is a four-step ritual — parse, check alg, verify signature, check claims — and skipping any single step turns the token into a free impersonation ticket.
CVE-2024-3400 Palo Alto GlobalProtect Command Injection: a CVSS 10.0 critical chain attack
CVE-2024-3400 is a command injection vulnerability in Palo Alto Networks PAN-OS GlobalProtect, scoring the maximum CVSS 10.0. An attacker triggers command injection via a crafted request and writes a cron job for persistence. The CVSS vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H indicates a chained impact across the entire enterprise. The session-id field flows into a shell command with insufficient escaping, so a single HTTP request can write a cron entry that survives reboots. The vulnerability was weaponized by APT actors within days, and Shadowserver observed mass scanning. The lesson is that an edge device that lets external input land in a shell command is the highest-value target in the perimeter.
CVE-2024-4439 WordPress Core Unauthenticated Stored XSS: Block Editor rendering chain
CVE-2024-4439 is an unauthenticated stored XSS in WordPress Core prior to 6.5, CVSS 7.2, located in the Block Editor. An attacker triggers XSS through carefully crafted post content, and when the victim views the post, malicious JavaScript executes, letting the attacker hijack accounts or plant backdoors. The Block Editor parses user-supplied HTML to extract block structures but does not strip event handlers, so a stored post can carry a live script. The combined effect of CVE-2024-4439 and CVE-2024-4440 in the same release forms a full chain: unauthenticated stored XSS plus an account-takeover that bypasses CSRF checks. The fix in 6.5 adds an HTML allowlist and an iframe sandbox to the embed block. The lesson: a CMS render path that takes user HTML is a XSS surface by default, and the only safe design is a strict allowlist.
CVE-2024-23724 Ghost CMS SVG Stored XSS: from avatar upload to Owner takeover
CVE-2024-23724 is a stored XSS in Ghost CMS 5.76.0. An attacker uploads an SVG containing JavaScript as a profile avatar, then lures the Ghost Owner to view the profile page, automatically transferring the Owner role to the attacker. The fix uses DOMPurify to sanitize SVG uploads. The chain runs in three steps: the attacker uploads the malicious SVG, the Owner's browser renders the avatar and executes the embedded script, the script then uses the active session to call the role-transfer API. SVG is a fully featured XML grammar; any unfiltered upload is a script-injection channel. The lesson is that an avatar uploader must reject active content, not just file extensions.
CVE-2024-29291 Laravel database credential leakage: the PDOException logging mistake
CVE-2024-29291 is a database credential leak in Laravel 8-11, CVSS 4.5. When a PDOException is thrown, Laravel writes the database DSN, username, and password in full to storage/logs/laravel.log (when APP_DEBUG=true), letting an attacker connect directly to the database once they obtain the log. The leak comes from the default exception renderer: the DSN is included in the message string, and that string is then written to the log unredacted. The log file is web-accessible on many default deployments. The fix in Laravel 11.7 redacts the password component. The lesson is that any exception renderer and any logger that prints driver-level strings is also a credential printer, and the right default is to redact everything that looks like a secret.
CVE-2023-7028 GitLab Account Takeover: dual-recipient password reset
CVE-2023-7028 is an account takeover in GitLab CE/EE prior to 16.1.0, CVSS 7.5. The /users/password endpoint accepts an array for user[email], causing GitLab to send the same password-reset link to both the victim and the attacker's address. The attacker uses the leaked token to reset the password. The Rails parameter parser interprets user[email][] as an array by default, so the attacker submits the victim's email first and the attacker's email second; the password-reset mailer iterates and sends to both. The fix rejects non-scalar email values at the controller boundary. The lesson: any controller that maps a single-valued field into a typed parameter parser must enforce the type at the boundary, not at the model.
CVE-2023-6553 WordPress Backup Migration Unauthenticated RCE: PHP filter chain weaponized
CVE-2023-6553 is an unauthenticated RCE in WordPress Backup Migration < 1.3.8, CVSS 9.8. The /includes/backup-heart.php endpoint mishandles user input, and an attacker can use a PHP filter chain to write a PHP shell to disk and execute arbitrary commands without authentication. The endpoint accepts a file-content parameter that passes through PHP's file_put_contents without checking the extension; the filter chain technique then rewrites the bytes into valid PHP one character at a time using base64 and rot13. The technique turns any write primitive into a code-execution primitive, even when the destination filename is fixed. The lesson: a write-to-server endpoint must constrain the path and the file type, not just the input string.
CVE-2023-51766 SMTP Smuggling Recap: Where Exim's End-of-Data Interpretation Breaks
CVE-2023-51766 is an SMTP smuggling flaw in Exim before 4.97.1, CVSS 5.3. This piece walks through the protocol-level end-of-data ambiguity, the path that lets outbound servers pass . while inbound Exim treats it as DATA termination, and the boundary conditions against GMX/Ionos/Exchange Online. The end-of-data sequence is a single byte: the line containing only a period (.). RFC 5321 calls it the data terminator, but the surrounding CR/LF rules differ across implementations; Exim historically accepted any of LF.LF, CR.LF, or LF. as a valid terminator, while many outbound senders emit a stricter one. An attacker who can choose the outbound terminator can hide a second envelope inside the same message. The lesson is that SMTP is line-oriented and tolerant, and tolerance at the protocol layer is a smuggling channel.
CVE-2023-31893 Vivo Play IPTV DNS Recursion DoS: amplification attack via carrier firmware
CVE-2023-31893 is a DNS recursion DoS in Telefônica Brasil's Vivo Play IPTV device (firmware 2023.04.04.01.06.15), CVSS 7.5. The device exposes DNS recursion to the public internet, letting an attacker spoof source IPs in DNS queries to trigger amplification responses that overwhelm the device. The fix is to disable recursion and restrict recursive clients to trusted networks. Open DNS recursion has been a known DoS primitive for two decades, yet carrier-grade CPE still ships with recursion enabled for the LAN. A single open resolver on the network becomes an amplification target: the attacker sends small DNS queries with the victim's IP as the source, and the resolver dutifully returns much larger responses. The lesson: any network device that listens on UDP/53 should default to no recursion, and recursion should be a deliberate per-VLAN config, not a build default.
CVE-2023-4357 Chrome XEE on WebBrowsers: from XML external entity to arbitrary file read
CVE-2023-4357 is an XEE (XML External Entity) vulnerability in Google Chrome, CVSS 8.8. An attacker crafts a malicious XML document that uses the browser's XML parser to read local files, requiring user interaction but with significant impact. The browser XML parser is shared by every component that handles SVG or SOAP, so the XXE primitive reaches into any feature that accepts user-supplied XML. A crafted SVG that references an external entity leaks the contents of files like /etc/passwd when the user merely views the page. The fix disables external entity loading in the parser. The lesson is that any XML parser exposed to user content must run with the XXE-safe configuration; allowing the default is always a file-read primitive.
CVE-2024-22144 WordPress GOTMLS Plugin Code Injection: a 200k-install string concatenation bug
CVE-2024-22144 is a code injection in the WordPress GOTMLS plugin prior to 4.21.96, CVSS 9.0, affecting more than 200,000 active installations. The plugin concatenates user input without sanitization, letting an attacker execute arbitrary PHP and write a webshell without authentication. The vulnerable function reads a user-supplied setting name, concatenates it into a call_user_func-style expression, and passes the result through eval(). A crafted setting name becomes a PHP statement. With 200,000 active installs the blast radius is significant: one unauthenticated POST and the server is owned. The fix in 4.21.96 removes the eval call and switches to a function-name allowlist. The lesson: any code path that calls eval() on user input is by definition a remote shell, no matter what the wrapper function looks like.
CVE-2024-34351 Next.js SSRF: Server Actions and the Host Header's Quiet Collusion
CVE-2024-34351 is an SSRF flaw in Next.js 14.1.1 and below, CVSS 7.5. When Server Actions handle a redirect starting with /, they build the fetch URL from the request Host header — so an attacker can point Next.js at any internal address. A Flask pivot turns it into a full-read SSRF. The fetch URL is constructed by combining the host header with a relative path; an attacker who controls the host header can redirect the fetch to an arbitrary internal service. A Flask receiver then serves internal-only responses back through the same channel. The fix in 14.1.2 hardens Server Actions against user-controlled hosts. The lesson: any internal fetch that uses request-time data to construct the URL is a SSRF, even when the path looks relative.
node-serialize Deserialization RCE: An Underestimated Trust Chain in a Node.js Library
node-serialize 0.0.4's unserialize() does no filtering on fields prefixed with _$$ND_FUNC$$_. Combined with an IIFE, this lets an attacker execute arbitrary Node.js code at the moment of deserialization. This post breaks down the mechanism, payload construction, reproduction path, and remediation guidance.
2023
CVE-2023-50164 Apache Struts: Path Traversal in File Upload to RCE
CVE-2023-50164 is a file upload path traversal flaw in Apache Struts 2.5.33 and 6.3.0.2 (and below), scored CVSS 9.8. Struts' ActionSupport treats the multipart field name as a property name for setter matching, with no validation of the resolved path; by renaming `upload` to `Upload` and appending an extra form parameter, an attacker can place a webshell outside the intended upload directory — typically straight into Tomcat's `webapps` folder, from where a one-line JSP stager turns into full RCE. The chain is unauthenticated, cross-component, and ends with the attacker holding a Tomcat process shell, able to pivot laterally across the host. The fix is server-side filename rewriting, physical isolation of the upload directory from `webapps`, and minimized Tomcat manager roles, layered on top of a mandatory Struts upgrade.
CVE-2023-51766 SMTP Smuggling: Sneaking Forged Mail Past SPF and DMARC
CVE-2023-51766 is an SMTP smuggling flaw in Exim prior to 4.97.1, scored CVSS 5.3. The core trick is that the outbound SMTP server treats a sequence like . as ordinary body text, while the inbound SMTP server treats the same sequence as the DATA terminator. That semantic disagreement lets an attacker piggyback arbitrary MAIL FROM, RCPT TO, and BDAT commands inside what looks like one message, so a sender using a shared IP pool (GMX, Ionos, Exchange Online) can impersonate any domain hosted on those providers. SPF and DKIM still pass, and DMARC alignment succeeds, because the inbound server sees the second message as a freshly arrived, internally valid SMTP session. The fix is not more authentication; it is strict outbound filtering of terminator-like sequences, upgrading inbound Exim, and broader adoption of BDAT to retire the legacy `.` terminator.
CVE-2023-49103 + CVE-2023-49105 ownCloud Info Leak + Privilege Escalation to RCE Chain: How PHPinfo Exposure Became the Attacker's Key
CVE-2023-49103 (CVSS 10) is an unauthenticated PHPinfo exposure in ownCloud <= 10.13.1 that lets anyone reach /settings/phpinfo and harvest the full PHP configuration, including the bundled ImageMagick version, the GraphQL endpoint, and writable temp directories. CVE-2023-49105 (CVSS 9.8) is a WebDAV URL signature forgery triggered by the default empty signing key: an attacker who knows a username can sign requests with the empty HMAC and impersonate that user against /remote.php/dav. Chained together, the two issues form a complete RCE path: PHPinfo gives reconnaissance, WebDAV forgery gives arbitrary-user file access, and an older ImageMagick issue (such as ImageTragick) turns a crafted upload into shell. The remediation is not just upgrading ownCloud; it is the eight-piece baseline of upgrade + WAF blocking phpinfo + private-only DAV + per-user signing keys + ImageMagick upgrade + audit logs + 2FA + config monitoring, applied simultaneously.
CVE-2023-43341 Evolution CMS Reflected XSS: Reflected Attack Surface in the Admin Panel
CVE-2023-43341 is a Reflected XSS in Evolution CMS prior to v3.2.3, CVSS 6.1. Attackers craft URLs with specific parameters (such as search and page) that reflect javascript: protocol in the Evolution admin panel, triggering XSS.
CVE-2023-38831 WinRAR Spoof: 0-Click Attack via Archive File Masquerading
CVE-2023-38831 is a spoofing flaw in RARLAB WinRAR prior to 6.23, scored CVSS 7.8. The trigger is a RAR5 archive that contains both a directory and an executable file sharing the same base name, e.g. `invoice.pdf/` next to `invoice.pdf.cmd`. When WinRAR extracts it, the directory entry is dropped on the floor and the `.cmd` is written to the current directory and silently auto-executed — no user prompt, no second click. CISA warned in 2023-09 that APT actors had already weaponised it, and finance / foreign-trade teams were the most heavily hit through phishing mail with RAR attachments. The remediation is patching to 6.23+, scanning RAR attachments at the mail gateway, monitoring abnormal WinRAR child process spawns at the endpoint, and treating any `directory + same-named executable` combination in an archive as hostile by default.
CVE-2023-38286 Spring Boot Admin SSTI: Thymeleaf Expression Injection to RCE
CVE-2023-38286 is a server-side template injection (SSTI) in spring-boot-admin < 3.1.0 + thymeleaf < 3.1.1, CVSS 9.8. Attackers craft specific request headers so that the Thymeleaf view layer parses malicious SpEL expressions, ultimately achieving RCE.
CVE-2023-4357 Chrome LibXSLT XEE: The XML External Entity Surface Browsers Forgot
CVE-2023-4357 is an XEE flaw in LibXSLT as used by WebKit-based browsers (Chrome, Safari, Samsung TV browser, plus any Electron/PhantomJS app that runs without --no-sandbox), scored CVSS 8.8. The library still allows external entities in XSL `document()` calls, so a crafted XSL/XML pair makes the browser read `file://` resources outside the sandbox — `/etc/hosts`, `/etc/shadow`, Windows system32 configs, even the macOS Keychain DB on Electron builds running un-sandboxed. The attack requires the victim to visit a hostile URL, which is what the UI:R segment of the vector represents. The fix is three things at once: disable external entities by default, enforce an explicit whitelist, and tighten the sandbox; layering those closes the 1999-era tunnel that was still wide open in 2023 browsers.
CVE-2023-3519 Citrix NetScaler RCE: Unauthenticated Remote Command Execution
CVE-2023-3519 is an unauthenticated remote code execution in Citrix NetScaler ADC and NetScaler Gateway prior to 13.1-49.15, scored CVSS 9.8. NetScaler's NSPPE packet processing engine has a heap buffer overflow in the HTTP request parser that lets a specially crafted HTTP request overwrite the return address and run shellcode directly inside the nsroot process — meaning a single unauthenticated request yields a root-equivalent shell. Mandiant and CISA warned in 2023-07 that APT groups had already weaponised it against US critical infrastructure, exfiltrating SSL VPN configurations and private certificates. The remediation is to upgrade immediately, force-rotate every SSL VPN private certificate (assume all credentials are now burned), restrict the management interface from external access, and watch `/tmp/` for the suspicious files attackers typically drop.
CVE-2023-25157 GeoServer SQLi: Property Injection in OGC API Filters
CVE-2023-25157 is a SQL injection in GeoServer prior to 2.22.1 / 2.21.4 (and several earlier branches), scored CVSS 9.8. The OGC Filter functions exposed via WFS GetFeature concatenate the `property name` parameter straight into the SQL subquery with no sanitization, so an attacker who controls the CQL_FILTER can splice arbitrary SQL clauses through functions like `strStartsWith` and `strEndsWith`. The injection is unauthenticated and reaches the underlying PostgreSQL/PostGIS backend, allowing full read of GIS data plus lateral movement to other databases via `dblink` or `COPY PROGRAM`. The fix is the OGC-correct approach: a strict whitelist in the property name parser, paired with database prepared statements, so the protocol's legitimate characters (`/`, `:`, numeric subscripts) can no longer be misused as SQL.
CVE-2023-24488 QR Code Generator XSS: A Stored XSS on code-projects.org
CVE-2023-24488 is a Stored XSS in the QR Code Generator Web application published on code-projects.org, CVSS 6.1. Attackers inject a javascript: protocol URL into the QR Code text field, and the generated QR Code triggers XSS when scanned or previewed.
2022
CVE-2022-48110 CKEditor 5 XSS: Sanitizer Gaps in data: URL Schemes
CVE-2022-48110 is a Stored XSS in CKEditor 5 prior to v35.4.0, CVSS 6.1. The model-view architecture that the editor adopted to eliminate XSS still hits a corner case during model-to-view deserialization: the HTML data processor allows a `data:` URL through in an `` tag, and the browser happily executes the base64-decoded payload when the victim clicks the link. The crafted payload wraps a full HTML document (with a `
CVE-2022-41082 Microsoft Exchange RCE: The SSRF Pre-Stage of ProxyNotShell
CVE-2022-41082 is a Server-Side Request Forgery in Microsoft Exchange Server prior to 15.2 (Build 986.5), CVSS 8.0, sitting at the front of the ProxyNotShell attack chain. The vulnerability lives in the Outlook Web Access `autodiscover.json` endpoint, where the `Email` field of an AutodiscoverV1 request is parsed as a URL and used by the Exchange back-end to make an outbound HTTP call. An attacker can steer that back-end call at Exchange's own internal PowerShell Remoting service (reachable on localhost by default), turning what looks like a low-severity SSRF into the prerequisite for the chained CVE-2022-41040 RCE. The full chain — SSRF reaching the internal PowerShell endpoint, then arbitrary PowerShell command execution under the Exchange SYSTEM identity — was mass-exploited by APT-class actors between September and December 2022, with thousands of Exchange servers compromised worldwide, and a non-trivial number of incidents ending in ransomware deployment. The lesson is that on a system like Exchange, which is both internet-facing and embeds an internal PowerShell service, any SSRF that bypasses URL validation is effectively a free RCE pre-stage.
MetaMask Browser Extension Wallet demonic Vulnerability Analysis
In June 2022, MetaMask disclosed the demonic vulnerability affecting versions < 10.11.3. When importing a seed phrase and clicking 'Show Secret Recovery Phrase,' the browser caches the plaintext seed phrase to the local disk's Sessions directory, making it readable by other applications or recoverable through physical access. SlowMist Security Team reproduced the vulnerability and assisted multiple extension wallet projects with remediation.
MetaMask Clickjacking Vulnerability Analysis: iframe Hijacking and Phishing Whitelist Bypass
In June 2022, MetaMask disclosed a severe Clickjacking vulnerability. Attackers could exploit the phishing.html page exposed via web_accessible_resources to embed the unlocked wallet page via iframe, tricking users into authorising transactions or bypassing phishing warnings. SlowMist Security Team reproduced the vulnerability and identified multiple affected Fork projects including Coinbase Wallet, Coin98 Wallet, and Maiar DeFi Wallet.
2021
Sky-High Fee Analysis: ethjs-util Floating-Point Data Processing Flaw
A transfer of 100,000 USDT that incurred a staggering 7,676 ETH transaction fee. The root cause is that ethjs-util's intToBuffer function does not support floating-point data. Divergent handling of floating-point hex strings between browser JS and Node.js leads to incorrect buffer values being written, ultimately producing erroneous fee calculations.
CVE-2021-39316 DZS Zoomsounds: Unauthenticated Arbitrary File Read
CVE-2021-39316 is an unauthenticated arbitrary file read in the DZS Zoomsounds WordPress plugin prior to version 6.45, CVSS 7.5. The plugin exposes a `download` endpoint via the `wp_ajax_nopriv_dzsapplies_readfile` action — a hook that any unauthenticated visitor can fire — and the handler reads whatever path the client passes in the `path` parameter with no allowlist and no traversal check. In practice the attacker passes `../../../wp-config.php` and gets back the database credentials, secret keys, and auth salts; a quick hop to `/etc/passwd` confirms the wider exposure. With the database password, the attacker can log straight into MySQL, modify the admin account, drop a malicious plugin, or write a PHP shell — the full ladder from a single unauthenticated GET to a server takeover. The interesting detail is that the hook itself isn't the bug; it's the combination of an unauthenticated AJAX entry point plus a file-read call that trusts the client. The fix in 6.46 is a path allowlist, but the broader lesson is that WordPress's `wp_ajax_nopriv_*` family is a permanent place to look for forgotten permission checks.
CVE-2021-34527 PrintNightmare: A SYSTEM-Level DLL Loading Trap in Windows Print Spooler
PrintNightmare (CVE-2021-34527, CVSS 8.8) is a remote code execution flaw in Windows Print Spooler disclosed in 2021. The vulnerability sits in the way RpcAddPrinterDriverEx handles pDataFile and pConfigFile: the first call stages a remote DLL from an attacker-controlled SMB share into the local spool drivers x64 3 directory, the second call uses a legitimate local pConfigFile to force a scan-and-load across the entire drivers directory, and the attacker's DLL gets dragged into the load chain as a side effect. The DLL then runs inside spoolsv.exe, which is SYSTEM — so the attacker lands at SYSTEM-level code execution with a single crafted SMB share. Real-world impact was severe: the disclosure on 2021-07-06 was followed by active mass-scanning within hours, and many enterprise environments were compromised end-to-end in days. This post walks through the vulnerability mechanism, the two-stage exploitation chain, the post-exploit process tree (spoolsv → rundll32 → cmd), and the layered remediation options — the 2021-07-06 security update, Point and Print Group Policy restrictions, and a temporary full disable of the Print Spooler service on servers that don't need to print.
CVE-2021-3129 Laravel Ignition RCE: Phar Deserialization Path in Debug Mode
CVE-2021-3129 is a phar deserialization RCE in Laravel 8.4.2 and below when Debug mode is enabled, exploiting the `_ignition/execute-solution` endpoint in Ignition 2.5.1 and below, scored CVSS 9.8. The root cause is a chain of three individual non-fatal choices that combine into a critical RCE: the convenience 'click to fix' endpoint accepts a class name and calls its `run()` method without authentication, the `phar://` stream wrapper remains enabled and silently deserializes the metadata field of any phar it touches, and Laravel's Monolog log file can be coerced into containing a payload that looks like a valid phar. The exploitation chain is a three-call sequence: clear the log, write a payload-bearing log entry, then trigger `phar://` parsing via the Ignition endpoint. The result is arbitrary PHP object instantiation in the web process context (typically www-data) — full RCE on the Laravel host. Patching is simple: upgrade to Laravel 8.4.3 or Ignition 2.5.2, and in production set `APP_DEBUG=false`. The broader lesson is that 'developer convenience' features are exposed as unauthenticated HTTP endpoints, and any active deserialization path in the runtime is a permanent invitation to attackers.
2020
CVE-2020-10770 Keycloak SSRF: One OIDC Parameter Exposes Internal Servers
CVE-2020-10770 is a Server-Side Request Forgery in Keycloak versions prior to 13.0.0, caused by improper validation of the `request_uri` parameter in the OIDC authentication flow, scored CVSS 6.1. The Keycloak server blindly follows any URL the attacker puts in `request_uri`, turning the identity provider itself into a proxy for arbitrary outbound requests. In practice this lets attackers reach internal services that are normally firewalled off, scan ports from the Keycloak server's network position, and — most damagingly — pull cloud-credential material from the IMDS endpoint at 169.254.169.254 on EC2/Azure/GCP, which often leads directly to cloud account takeover. The root cause is a missing URL egress control on a feature designed to fetch a signed `request_uri` JWT from a known client: Keycloak 12.x and earlier forwarded the parameter as-is to its HTTP client, so any URL the attacker placed there was fetched on the server's own network. Patching to 13.0.0+ closes the hole, but until then operators need an explicit network egress policy blocking private IP ranges and IMDS, plus a forced move to IMDSv2 on EC2.
CVE-2020-5902 F5 BIG-IP TMUI RCE: From File Read to Root Command Execution
CVE-2020-5902 is a pre-authentication RCE in F5 BIG-IP's Traffic Management User Interface, scored CVSS 9.8. The flaw chains a directory-traversal bypass in the TMUI URL parser with the hidden tmsh alias interface, letting an unauthenticated remote attacker read arbitrary files and ultimately land a root shell on the appliance. F5's TMUI exposes an entire layer of developer-intended endpoints (fileRead.jsp, tmshCmd.jsp) that should never be reachable from outside. The trust model that BIG-IP's ADC layer sits on collapses the moment that layer is reachable.
CVE-2020-981 CKEditor 4 XSS: Sanitizer Boundaries in Rich Text Editors
CVE-2020-981 is a sanitizer bypass in CKEditor 4 prior to v4.13, scored CVSS 6.1. The built-in HTML filter accepts combinations of `` plus a CSS-positioned overlay form, letting an attacker plant a Stored XSS that triggers on the victim's first click. The flaw shows up in any web application that embeds CKEditor 4 — forums, CMS, mail clients — and is routinely chained into a foothold step for cookie theft, CSRF, and ultimately RCE. The fix in v4.13 moved to a strict whitelist combined with context-sensitive attribute validation, which is the more modern industry direction.
CVE-2020-0601 CurveBall: ECC Elliptic Curve Spoofing in Windows CryptoAPI
CVE-2020-0601 is a flaw in Windows CryptoAPI (Crypt32.dll) where the ECC certificate validator compares public-key coordinates but does not verify that the curve parameters themselves match the issuing CA, scored CVSS 7.8. The attacker constructs an isomorphic keypair against a trusted CA's public key and signs certificates that pass the entire Windows trust chain. Any application that calls into CryptoAPI — Edge, Outlook, IE, SMB signing, Authenticode, S/MIME — inherits the same blind spot, so the impact covers Windows 10 1709 through 1909 and Windows Server 2016/2019. The fix adds an explicit curve-parameter comparison in the chain validator.
2019
CVE-2019-15107 Webmin Unauthenticated RCE: command injection in password_change.cgi
CVE-2019-15107 is a pre-authentication command injection in Webmin <= 1.920, scored CVSS 9.8 Critical. The vulnerability lives in `password_change.cgi` when the user-password-change feature is enabled (`passwd_mode=2`, on by default in Webmin < 1.890). An unauthenticated attacker injects a pipe character into the `old` parameter, which is interpolated into a Perl `qx{}` shell context used by `unix_crypt` to read `/etc/shadow` for old-password validation — turning a password primitive into an RCE primitive. The fix in Webmin 1.930 replaces `qx{}` with `system(list)` and a parameter whitelist, structurally breaking the input-string-equals-executable-command equivalence.
2017
XXE Learning Path: Step by Step
A step-by-step walkthrough of XML External Entity (XXE) injection — from DTD basics and entity declarations to in-band and out-of-band exploitation, covering file/http/php protocols, parameter entity OOB exfiltration, and the extended attack surface of schemaLocation, XInclude, and XSLT. Notes added on libxml2 evolution, PHP 8 defaults, and the OWASP Top 10 2021 merge into Security Misconfiguration.
A First Look at PHP Deserialization and POP CHAIN
PHP object deserialization remains a classic topic in Web security. Starting from a basic __destruct exploitation, this primer walks through cross-class data flow tracking to construct a POP CHAIN, then supplements the picture with phar stream wrapper deserialization, PHP 8's new __unserialize interface, and modern framework gadget chains like phpggc. A revised edition of the 2017 introductory write-up.
A Brief Summary of File Inclusion and PHP Pseudo Protocols
A systematic walkthrough of PHP file inclusion vulnerabilities and the common pseudo protocols (file://, php://filter, php://input, zip://, bzip2://, zlib://, data://) tested against every combination of allow_url_fopen and allow_url_include, with notes on the PHP 5.3.4 null-byte fix and modern PHP 7+/8.x hardening.
Thoughts from a CTF Challenge: A Few MySQL Quirks
A walk-through of a MySQL blind SQL injection CTF challenge, focusing on four often-overlooked MySQL behaviors: case-insensitive string comparison, numeric string equality, hex() returning a string, and char() returning a BINARY string. Covers using double hex() encoding to bypass filters and achieve case-sensitive blind injection, with a Python 3 automation script.
CVE-2017-9841 PHPUnit eval-stdin.php Remote Code Execution: When a PHP Testing Framework Becomes a Web Entry Point
CVE-2017-9841 is a pre-authentication remote code execution in PHPUnit's `eval-stdin.php` file, scored CVSS 9.8. The file is designed to accept PHP code through the CLI, but when the entire vendor directory is shipped to production it sits directly under the web root and turns a single unauthenticated POST into arbitrary code execution. The exposure pattern repeats across every PHP project that bundles dev dependencies into production: framework, CMS, package manager, or web root configuration. The fix is not just deleting the file — it is the six-piece baseline of delete + `composer --no-dev` + WAF block + periodic scan + CI/CD gate + yara rule, applied simultaneously.
2016
CVE-2016-3053 IBM AIX Privilege Escalation: A Missing Trust Check in libc System Calls
CVE-2016-3053 is a missing EUID check in the AIX 6.1 / 7.1 / 7.2.0.2 libc implementations of `setauthdb` and `ruserok`, scored CVSS 9.8. A local unprivileged account can flip the authentication database and write passwordless trust for any host+root pair, then `rlogin` straight into a root shell without ever owning a root credential. The flaw is most often weaponized after a lower-privilege foothold — a compromised web user, a misconfigured daemon, a shared virtualization host — and is exactly the kind of bug that turns a single low-priv shell into full system compromise. The fix ships in IBM APARs IV88616 / IV88617 / IV88618 and depends on the AIX release.