Vulnerability | Think like an attacker, defend like a guardian

2018

$Copper-orange fractured chain links and cracks across a digital surface over a near-black teal-blue background, symbolizing the attack chain from SQL injection piercing query boundaries through to GetShell$

Security Research

Code Audit: Axublog Frontend SQL Injection to Backend GetShell

Axublog v1.0.6: frontend SQLi filter bypass, hardcoded authcode key, and backend file write chain into a full GetShell path.

2018-01-02 6 min #Vulnerability

2017

$Copper-orange fractured chain links and a keyhole leaking light over a near-black teal-blue background, symbolizing the chained attack of PHPCMS arbitrary file download bypass and SQL injection piercing$

Security Research

PHPCMS 9.6.2 Audit: Arbitrary File Download Bypass and Front-End SQL Injection

Audit walkthrough of PHPCMS 9.6.2: bypassing the arbitrary file download patch with %81-%99 high bytes to leak auth_key, then forging cookies via the dual-layer sys_auth scheme to trigger updatexml error-based SQL injection — a full chain from anonymous visitor to database dump.

2017-12-19 8 min #Vulnerability

$Copper-orange fractured chain links and a glowing fissure in a security boundary over a near-black teal-blue background, symbolizing a payload piercing the DuomiCms global SQL filter$

Security Research

Code Audit: DuomiCms Global Filter Bypass

A code audit of DuomiCms's cardpwd parameter that starts from the CNVD-2017-22079 arbitrary-recharge flaw and ends up bypassing the 80sec CheckSql global filter. By abusing the 'full SQL check' block that replaces single-quoted content with $s$ before scanning, a quote-mismatch payload with double-quote/backtick escaping slips extractvalue error-based injection past the global defense.

2017-11-21 8 min #Vulnerability

$Dark dossier-style cover with copper-orange fractured chain links and cracked digital interface layers, symbolizing the chained attack from CLIENT-IP injection through stored XSS to a CSRF-dropped shell$

Security Research

APPCMS Code Audit: SQL Injection, XSS, CSRF and GetShell

A full audit of APPCMS comment.php: a CLIENT-IP header insert injection, chained with stored XSS to hijack admin sessions and CSRF to drop a webshell — plus modern defense commentary.

2017-11-17 9 min #Vulnerability

$Copper-orange fractured chain links and a database keyhole leaking faint light over a near-black teal-blue background, an injection query piercing the database boundary layer — symbolizing Oracle SQL injection and database security research$

Security Research

Oracle SQL Injection Techniques: A Summary

A practical summary of Oracle SQL injection techniques covering UNION, error-based, out-of-band, boolean blind, and time-based blind injection. Highlights Oracle-specific quirks (the dual dummy table, strict type matching, data dictionary views) and updates the 2017 payloads with 11g R2 ACL restrictions and modern defense guidance.

2017-08-31 9 min #Vulnerability