christbowel
IT Sicherheit, meine Leidenschaft :)
Offensive Security
Researcher &
Software Security.
Turning attack surfaces into CVEs.
×13// intelligence_feed
Latest Writeups.
XSS2Shell: Technical Analysis
A pre-auth reflected XSS in WordPress Core, patched in 7.0.3. Two sanitizers disagree about what a tag is, and a username walks through the gap. This is the breakdown: gdb on the PHP tokenizer, the real affected range (which every public writeup got wrong), the JS gadget the patch did not touch, and a detector.
From One Row of Data to a Root Shell: Five CVEs in Perspective 5.0.0
Five vulnerabilities in the Perspective analytics engine, including an unsandboxed eval() in the query path and a stored XSS in the plugin that loads by default. Chained, they take an attacker from writing one row of data to command execution on the server host.
wp2shell: anatomy of a pre-auth RCE in WordPress Core
How two one-line oversights chain into code execution on 500 million sites