"Builder n' breaker seduced by the dark side"
Open-source command injection detection and exploitation. The tool, the testbed, and the research behind it. Est. 2014.
Apache Superset's (before 3.0.4, from 3.1.0 before 3.1.1) error handling can be manipulated in order to allow unauthorized data retrieval from the backend database.
The Blog module in Kentico CMS 5.5 R2 build 5.5.3996 allows SQL injection via the tagname parameter.
openmediavault before 4.1.36 and 5.x before 5.5.12 allows authenticated PHP code injection attacks, via the sortfield POST parameter of rpc.php, because json_encode_safe is not used in config/databasebackend.inc. Successful exploitation allows arbitrary command execution on the underlying operating system as root.
An OS Command Injection vulnerability in the endpoint_devicemap.php component of Fonality Trixbox Community Edition allows an attacker to execute commands on the underlying operating system as the "asterisk" user. Affects versions 1.2.0 through 2.8.0.4.
Black Hat Europe - Amsterdam, Netherlands
Show publication →Security BSides - Athens, Greece
Show publication →Hackerspace Sectalk - Athens, Greece
Show publication →OWASP Summit - Portugal, Lisbon
Springer - International Journal of Information Security
Show publication →IEEE International Symposium on Signal Processing and Information Technology (ISSPIT)
Show publication →Information Management & Computer Security
Show publication →IEEE International Symposium on Signal Processing and Information Technology
Show publication →