Exploiting authorization by nonce in WordPress plugins
Target Program: Wordfence
🎯 Vulnerability: Remote Code Execution (RCE)
💡 Defense Fix: Avoid executing shell commands via system(). Use parameterized APIs and strict input sanitization.
More Writeups Like This
pentester.land
by Guilhem Rioux (@GuilhemRioux)From a GLPI patch bypass to RCE
pentester.land
by Harsh Jaiswal (@rootxharsh), Rahul Maini (@iamnoooob)Hacking Apple - SQL Injection to Remote Code Execution
pentester.land
by X-C3LL (@TheXC3LL)A christmas tale: pwning GTB Central Console (CVE-2024-22107 & CVE-2024-22108)
pentester.land
by watchTowr (@watchtowrcyber)