CVE-2020-7246: A remote code execution (RCE) vulnerability in qdPM 9.1 During a security research I conducted against CVE-2020-7246, I discovered a clever method to exploit arbitrary file deletion to bypass .htaccess resrictions. Vulnerable endpoint: index.php/myAccount/update Vulnerability and exploitation:The exploit begins by sending two requests with users[remove_photo] set to 1 and users[photo_preview] set
CVE-2023-30019: SSRF in imgproxy<=3.14.0 GitHub - imgproxy/imgproxy: Fast and secure standalone server for resizing and converting remote imagesFast and secure standalone server for resizing and converting remote images - GitHub - imgproxy/imgproxy: Fast and secure standalone server for resizing and converting remote imagesGitHubimgproxyimgproxy is a fast and secure standalone server for resizing
Analyzing a Broken Authentication Vulnerability in Golang Analytical article of couple code snippets that will introduce us to the skill of code review, and a brief explanation of Broken Authentication vulnerablity. What is an Authentication?Authentication is the process to verify the user identity from the data provided by him/her, and authentication can be implemented in
My attempt to reverse the Discord Nitro tokens. If you are not familiar with Discord, nitro is a kind of membership, you pay to get access and do some cool things on Discord, like get a GIF profile picture or upload large size photos and videos, and in order to get it you must either buy it directly
OAuth2 flaw leads to one-click Account TakeOver in 42 intra. This is an article about a vulnerability I found in 42 intra (a website to manage the activities of 42 students) leads to one-click account takeover by stealing API client token. 42 intra uses "doorkeeper" as an OAuth2 provider: GitHub - doorkeeper-gem/doorkeeper: Doorkeeper is an OAuth 2 provider for
