categories
tags
RCE·Vulnerability Research
·
RCE·Privilege Escalation·Enumeration·Misconfiguration·Default Credentials
Who Watches the Watchman? Hacking a SIEM Server to SYSTEM
A penetration test writeup demonstrating how default credentials on a SIEM appliance led to configuration file disclosure, MySQL root access, UDF injection, and full host compromise as NT AUTHORITY\SYSTEM.
2026-10-26
33
0
9 min read
Web Application Security·Business Logic
·
Payment Security·Enumeration
Checkout Price Manipulation: How a Business Logic Flaw Let Customers Set Their Own Price
A business logic vulnerability allowed arbitrary price manipulation during checkout on an e-commerce platform. The fix landed quickly, the vendor's silence afterward did not.
2026-07-06
642
4
5 min read
XSS·Injection·Account Takeover
·
Enumeration·Account Takeover
Stored XSS to Full Account Takeover: Chaining a Hybrid Markdown Parser Flaw with localStorage Token Theft
A red team case study showing how an unsanitized hybrid Markdown parser led to stored XSS, and how that XSS was chained with localStorage-based token theft to achieve full admin account takeover.
2026-07-02
720
3
7 min read
RCE·Vulnerability Research
·
RCE
CVE-2026-58409 : Authenticated Remote Code Execution (RCE)
Technical breakdown of an authenticated RCE in ChurchCRM (GHSA-37mf-vq43-5qp9). Insecure extension allowlist in PluginInstaller.php allows .php files to be extracted directly under the web root, enabling full server compromise.
2026-06-19
575
2
4 min read
RCE·Vulnerability Research
·
RCE·CMS
CVE-2026-53767 & CVE-2026-53768: Authenticated RCE via Chained Upload Path Bypass in Chyrp Lite
Technical breakdown of CVE-2026-53767 and CVE-2026-53768: a chained RCE in Chyrp Lite ≤ 2026.01 via uploads_path blocklist bypass and missing file extension validation. Full PoC included.
2026-06-11
632
0
4 min read
RCE·File Upload Bypass·Command Injection
·
RCE·Misconfiguration·File Upload Bypass
Unauthenticated RCE in CKFinder via Null Byte Injection Vulnerability
A real-world pre-auth RCE chain: exposed CKFinder with no authentication, null byte filter bypass to upload a .cfm webshell, and OS command execution via ColdFusion cfexecute. Full PoC walkthrough.
2026-06-07
726
2
5 min read
Vulnerability Research·CVE·Injection
·
CVE·SQLi
CVE-2026-54597: Authenticated Time-Based Blind SQL Injection in ITFlow
Technical breakdown of an authenticated time-based blind SQL injection in ITFlow (GHSA-m63v-j7fw-hq2h). The expires parameter in agent/ajax.php bypasses sanitizeInput() entirely in a raw INTERVAL context, enabling full database exfiltration. Detailed PoC and fix analysis.
2026-06-03
1059
1
7 min read
Vulnerability Research·Injection
·
Enumeration·SQLi
CVE-2026-54596: Authenticated SQL Injection via recurring_invoice_frequency Parameter Enables Full Database Exfiltration
Technical breakdown of an authenticated SQL injection in ITFlow (GHSA-f9m3-qjc9-v27j). The recurring_invoice_frequency POST parameter bypasses sanitizeInput() in a DATE_ADD INTERVAL context, enabling full database exfiltration and second-order injection. Detailed PoC and fix analysis.
2026-06-03
867
0
7 min read
Cloud·AWS
·
Misconfiguration·AWS S3
From Presigned URL to Data Exposure: Exploiting a Misconfigured MinIO Instance
How an unauthenticated presigned URL endpoint and a public MinIO bucket misconfiguration exposed over 3GB of corporate internal documents during an authorized red team engagement.
2026-05-31
733
2
6 min read
CVE·Vulnerability Research
·
Authorization Bypass·CVE·Snipe-IT
CVE-2026-48493: Privilege Escalation via Permission Bypass in Snipe-IT
Technical breakdown of CVE-2026-48493: Users with users.edit permission escalate to near-full system access via PreserveUnauthorizedPrivilegedPermissionsAction bypass. Detailed PoC and impact analysis.
2026-05-28
422
2
3 min read