Technical Tag
5 related articles.
Preface A tweet last night attracted considerable attention in the security community. Log4j 2.17.0 has RCE!! Yet the community mostly scoffed: RCE after modifying a configuration file—is that all? So how did configuration-file RCE become fashionable? The story begins…
0x01 Preface While following up on Log4j 2, I found several interesting details and recorded them here. 0x02 Is Log4j Never Vulnerable to JNDI Injection? First, a question: is Log4j never vulnerable to JNDI injection? No. I found an interesting exchange in a Log4j 2 pull request. Someone argued that Log4j is vulnerable…
0x01 Preface. WeEngine CMS quietly fixed an SQL injection vulnerability in version 2.0. No analysis of the injection point could be found online, so this article examines its exploitation. 0x02 Affected versions. Testing shows the vulnerability in v1.5.2 from the official GitLee repository and a fix in 2.0, so at least v1.5.2 is affected…
0x00 Preface. Xu recently told me Qishi CMS had patched a problem in the global assign_resume_tpl function and asked whether it was exploitable. The official advisory points to /Application/Common/Controller/BaseController…
0x01 Preface I encountered a vulnerability that pads input with 800,000 junk characters, exceeding the regex backtracking limit and bypassing the 360 module. This article explains regex backtracking and analyzes the maccms v8 RCE. 0x02 Regex Backtracking 1. Regex Engines We all know the 'regex' in 'regex backtracking,' but what is backtracking? Before that, consider regex engines…