Exploiting Local File Inclusion Vulnerability in phpMyAdmin: A Step-by-Step Guide
A local file inclusion vulnerability (CVE-2018-19968) in phpMyAdmin (v4.8.0-4.8.3) was disclosed, caused by improper handling of Transformation parameters.
Category: Network security
Understanding Redis Vulnerabilities: Exploiting Unauthorized Access and Prevention Measures
Redis vulnerabilities can expose servers to unauthorized access if no authentication is set, allowing attackers to gain control via SSH key injection.
Understanding Hadoop Unauthorized Access: Exploits, Risks, and Mitigation Strategies
Hadoop unauthorized access allows attackers to exploit configuration issues, execute commands, and deploy malware like cryptocurrency miners. Mitigation is crucial.
Understanding the Unauthorized Access Vulnerability in Nexus Repository Manager 3: Exploiting JEXL Expressions
Nexus Repository Manager 3 (v3.14.0 and earlier) has an unauthorized access vulnerability in JEXL expressions, enabling arbitrary command execution.
Understanding FFmpeg Vulnerabilities: Exploiting HLS m3u8 Files for SSRF and Arbitrary File Read
FFmpeg, a powerful open-source video processing tool, can face SSRF and file read vulnerabilities via forged HLS m3u8 files due to improper validation.
Understanding XXE Vulnerabilities: Risks and Exploitation Techniques in XML Input Parsing
XXE (XML External Entity) is an injection attack exploiting XML input parsing with external entities enabled, leading to severe risks like file access…
PostgreSQL Vulnerability: Exploiting Logical Errors in Versions 9.3 to 10 for Unauthorized Code Execution
PostgreSQL vulnerability in versions 9.3–10 allows superusers to unknowingly trigger malicious code by regular users, leading to data exposure.
Mastering PHP Code Auditing: Understanding Wide Byte Injection and AddSlashes() Bypass
Studying PHP code auditing, I revisited wide byte injection using sqli-labs. It exploits GBK encoding to bypass `addslashes` and enable SQL injection.
Comprehensive Guide to Exploiting the MS17_010 Vulnerability Using Meterpreter for Post-Exploitation
The article explores exploiting the ms17_010 vulnerability using Meterpreter, detailing post-exploitation steps like privilege escalation, token stealing, and remote desktop access.
Uncovering a Logical Vulnerability: How I Exploited a Password Reset Flaw in China Unicom’s Authentication System
The article analyzes a logical vulnerability in China Unicom’s password reset mechanism, where brute-forcing the current password was possible due to lax restrictions.
Load More