Tag - exfiltration

  • Home
  • Tag - 
  • exfiltration

SIRI WI400: XSS on Login Page – CVE-2022-48111

WI400 is a software developed by SIRI that acts as a web interface for the IBM Power Systems (AS/400). During a penetration test activity, a reflected cross-site scripting (XSS) vulnerability was found on the login page. This allowed to craft URLs with arbitrary JavaScript code injected that would execute once the link was visited. Advisory -...
20/02/2023By Read more...

Analysis of a Command Injection in VBScript

In this writeup we present the analysis and exploitation of a VBScript command injection vulnerability we stumbled upon during a penetration test on a .NET web application. What makes this vulnerability stand out is the fact that at first glance it could be mistaken for a common SQL injection. After a few exploitation attempts, we...
14/07/2022By Read more...