Research Category
Code auditing…
0x00 Preface. I created this series because online Java code-audit material is usually fragmented and unfriendly to beginners. I am also learning Java auditing, so the series records and summarizes that process. It is intended for readers with basic Java syntax knowledge and will cover…
0x01 Preface. WeEngine CMS quietly fixed an SQL injection vulnerability in version 2.0. No analysis of the injection point could be found online, so this article examines its exploitation. 0x02 Affected versions. Testing shows the vulnerability in v1.5.2 from the official GitLee repository and a fix in 2.0, so at least v1.5.2 is affected…
0x00 Preface. Xu recently told me Qishi CMS had patched a problem in the global assign_resume_tpl function and asked whether it was exploitable. The official advisory points to /Application/Common/Controller/BaseController…
0x01 Preface. Xu recently pointed out a path from a low-privilege FastAdmin backend account to a shell. This article analyzes it. Affected versions: V1.0.0.20191212 beta and earlier. 0x02 Authorization. The main difficulty is that low-privilege users cannot access shell-related features…
Affected version: V1.0.0.20200506 beta, the latest release. Requirement: the member center must be enabled in /application/config.php. Vulnerability analysis: lines 58–67 of /application/index/User.php. user_request_empty is a developer hook and can be ignored; the important part is return $thi…
0x00 Preface. I created this series because online Java code-audit material is usually fragmented and unfriendly to beginners. I am also learning Java auditing, so the series records and summarizes that process. It is intended for readers with basic Java syntax knowledge and will cover…
0x01 Preface. Xu provided this vulnerability for me to analyze. 0x02 SeaCMS overview. SeaCMS is a PHP 5.x + MySQL video-on-demand system; FOFA shows over 400 instances. 0x03 Analysis. Vulnerable file: ./comme…
0x01 What Is Reflection? Reflection is a Java feature absent from C/C++. It lets a running program inspect itself and operate on internal properties of classes and objects. Oracle explains: 'Reflection enables Java code to disc…'
0x00 Preface. I created this series because online Java code-audit material is usually fragmented and unfriendly to beginners. I am also learning Java auditing, so the series records and summarizes that process. It is intended for readers with basic Java syntax knowledge and will cover…
0x01 Preface I encountered a vulnerability that pads input with 800,000 junk characters, exceeding the regex backtracking limit and bypassing the 360 module. This article explains regex backtracking and analyzes the maccms v8 RCE. 0x02 Regex Backtracking 1. Regex Engines We all know the 'regex' in 'regex backtracking,' but what is backtracking? Before that, consider regex engines…
0x00 Preface. I created this series because online Java code-audit material is usually fragmented and unfriendly to beginners. I am also learning Java auditing, so the series records and summarizes that process. It is intended for readers with basic Java syntax knowledge and will cover…
0x00 Preface. I created this series because online Java code-audit material is usually fragmented and unfriendly to beginners. I am also learning Java auditing, so the series records and summarizes that process. It is intended for readers with basic Java syntax knowledge and will cover…
0x00 Preface. I created this series because online Java code-audit material is usually fragmented and unfriendly to beginners. I am also learning Java auditing, so the series records and summarizes that process. It is intended for readers with basic Java syntax knowledge and will cover…
I. Preface A year of graduate-exam preparation is finally over. It did not follow my original plan, but I made it through. With time available, I am writing the code-auditing principles and practice series I had long planned. It explains web-vulnerability principles through CVE cases, including SQL injection, XSS, upload, and code-execution issues. Because it is long, it will be split into a series. These are personal study notes; corrections are welcome…
I. Background. I happened across a CMS and casually tested it for CSRF. The attack failed, so I inspected its CSRF defense. II. Process. Start from a simple administration page and attempt a CSRF attack that adds an administrator. The request transmits a plaintext password and uses JSON. I previously described how to construct a CSRF request in this format at /talksafe/116…
I. Reinstallation vulnerability. Like other CMS products, this application uses a lock file to determine whether it has been installed. Because the check occurs only in step 1, an attacker can POST directly to steps 2 and 3 and reinstall it. Analysis of Install/Index.php: $submit = isset($POST['s…
I. Preface After June began, I had more free time. Several competitions were over, and there were temporarily no tasks from NSFOCUS before I started work in July. I chose previously audited source code and reviewed it myself to identify gaps and gain experience. I had also promised at a T00ls meetup to publish an article, so after years of lurking, here is this somewhat unstructured CMS audit…