Deschide articolul original într-un tab nou Schimbarea acestei opțiuni se aplică imediat și reîncarcă pagina.
LECTURA
Înapoi la articole →

Sorcery Blog

blog.sorcery.ie/index.xml
Vizitează site-ul

Cel mai recent articol

Ultima verificare

Urmăritori 0 urmăritori
Articole: 16

  1. Adminer - SQLite RCE Regex Filter Bypass (CVE-2026-15686)

    (Sorcery Blog)

    Adminer is a PHP database management tool.

  2. Embedding Payloads in GIF File Using the Global Color Table

    (Sorcery Blog)

    Some vulnerabilities require you to have a file on the server containing your payload.

  3. CFOR Exploit - Recovering Deleted and Private Github Commits

    (Sorcery Blog)

    CFOR stands for Cross Fork Object Reference.

  4. MyBB Admin Panel RCE CVE-2023-41362

    (Sorcery Blog)

    This blog post explores a critical vulnerability in MyBB’s admin panel, leading to authenticated Remote Code Execution (RCE).

  5. SQLi in SimpleImportProduct Prestashop Module CVE-2023-39675

    (Sorcery Blog)

    This blog post details an SQL Injection we found within SimpleImportProduct, a Prestashop module developed by MyPrestaModules.

  6. PHPInfo Exposure in MyPrestaModules Modules CVE-2023-39677

    (Sorcery Blog)

    Two modules that we tested by MyPrestaModules have a vulnerability where PHPInfo is exposed to an unauthenticated attacker.

  7. XSS in FieldPopupNewsletter Prestashop Module CVE-2023-39676

    (Sorcery Blog)

    This blog post details an XSS we found within the FieldPopupNewsletter module, developed by FieldThemes, for the popular ecommerce platform Prestashop.

  8. SQLi in XIPBlog Prestashop Module CVE-2023-27847

    (Sorcery Blog)

    This is a belated stub post about SQLi vulnerabilities I found in XIPBlog (a Prestashop modules developed by Xpert-Idea) back in 2021.

  9. HigherLogic Community RCE Vulnerability

    (Sorcery Blog)

    We initially became interested in the __VSTATE parameter after reading this article by graanl which we saw after reading this article from The Record about an APT group exploiting how it works.

  10. Auth Bypass in ADOdb CVE-2021-3850

    (Sorcery Blog)

    I first decided to look at phpPgAdmin after reading this blog post that someone wrote up about abusing it to get a bug bounty.

  11. Proof of Concept for CVE-2021-38314 (Redux Framework)

    (Sorcery Blog)

    In order to understand this bug I first read through the Wordfence blog post and then read through through the Redux Framework source code to fill in the gaps.

  12. SQLi in SmartBlog CVE-2021-37538

    (Sorcery Blog)

    This blog post details an SQLi I found in the SmartBlog Prestashop module by SmartDataSoft.

  13. SQLi in ph_simpleblog CVE-2021-36748

    (Sorcery Blog)

    This blog post details an SQLi I found in Blog for Prestashop (ph_simpleblog) by Prestahome, it is also my first CVE 😊 To begin with I had to identify that the module was installed, it is a blog plugin so this can generally be spotted by looking at the pa…

  14. Adminer - A Guide For All its Vulnerabilities

    (Sorcery Blog)

    Adminer is a popular PHP database management tool.

  15. The Time I tried to get a Bounty from Binance

    (Sorcery Blog)

    Back in 2018 Binance had been targeted by a large scale attack by a group of phishers.

  16. Exposed .git Folder and How To Remediate it

    (Sorcery Blog)

    Discovery Usually we find this when directory bruteforce returns positive results from the following urls: http://site.com/.git/ http://site.com/.git/config http://site.com/.git/HEAD http://site.com/.git/index Many times the .git/ may be 403 (due to dire…