Technical Tag
4 related articles.
0x01 Preface. WeEngine CMS quietly fixed an SQL injection vulnerability in version 2.0. No analysis of the injection point could be found online, so this article examines its exploitation. 0x02 Affected versions. Testing shows the vulnerability in v1.5.2 from the official GitLee repository and a fix in 2.0, so at least v1.5.2 is affected…
0x01 Preface. Xu recently pointed out a path from a low-privilege FastAdmin backend account to a shell. This article analyzes it. Affected versions: V1.0.0.20191212 beta and earlier. 0x02 Authorization. The main difficulty is that low-privilege users cannot access shell-related features…
0x00 Preface. I created this series because online Java code-audit material is usually fragmented and unfriendly to beginners. I am also learning Java auditing, so the series records and summarizes that process. It is intended for readers with basic Java syntax knowledge and will cover…
I. Preface A year of graduate-exam preparation is finally over. It did not follow my original plan, but I made it through. With time available, I am writing the code-auditing principles and practice series I had long planned. It explains web-vulnerability principles through CVE cases, including SQL injection, XSS, upload, and code-execution issues. Because it is long, it will be split into a series. These are personal study notes; corrections are welcome…