Collaborate Disseminate
I have a website that is running Wordpress 5.0. I can update the WordPress but that will also break some of my plugins. Recently I have seen the following exploit on the internet
https://www.exploit-db.com/exploits/50663
that allows SQL In… Continue reading SQL Injection in WordPress
While running a VPS for shared hosting, I put the data for the various users and websites as /var/www/[USER]/public_html/[DOMAIN]/…. I’d like to make sure that one user cannot access data from another user. I run NGINX + PHP-FPM on CentO… Continue reading Prevent read access to other users’ files using SELinux
I’m studying, but I don’t know how to approach it, please help
Both nginx/1.20.2 php/5.4.16 were written in the header
nmap
80/tcp open http
443/tcp open https
8080/tcp open http-proxy
8443/tcp open https-alt
php.ini
display_errors… Continue reading Vulnerability help in nginx/1.20.2 php/5.4.16 [closed]
I pwned you! Gizza job! You know it makes sense! Continue reading PHP Packagist supply chain poisoned by hacker “looking for a job”
I’m currently working on a cyber wargame using LFI to get an RCE. However, there are not many readable files such as log files and environ. What attack should I try to read the flag? In the case of flag, it exists as an executable file wit… Continue reading Lfi to rce in PHP [closed]
I’m new to PHP and Apache. I come from Node.js/Java backends and I’m new to this tech stack (PHP, CGI, Apache etc). My site currently uses ckeditor to handle user uploads and has high traffic. Often, someone, somehow just changes the names… Continue reading PHP website getting hacked – dir names changed [closed]
I came across a CTF that i’m trying to solve, the goal is fairly simple: Bypass the authentication form and access the admin-restricted area. You can find the code snippet below.
Things to consider:
The CTF is a simulation and a demonstra… Continue reading PHP CTF: Vulnerabilities in PHP before 2007?
I’m trying to figure out if the code below is open to object injection:
<?php
// loggin level
define(‘CRIT’, 5);
define(‘ERROR’, 4);
// secret is defined somewhere in the script like this
define(‘SECRET’, ‘mYs3cr37P4… Continue reading PHP code review: is it open to object code injection through unserialize [closed]
See bellow php code that takes a url param, queries a db and then returns a string:
$inpt = ereg_replace("[^A-Za-z0-9" . ” . "]", "", $_GET[‘param’]);
$rtrn = $core_db->Execute("Select col1, col2, … Continue reading This is supposed to be vulnerable to SQL injection but I can’t really see how. Is it really that bad?
My hosting provider reported the following harmful file on my server
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=windows-utf-8">
<title>utf</title>
</head&g… Continue reading What harm did the potentially hazardous file on my server cause? [closed]