PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Is Assessing Your SaaS Providers Worth It? Uncovering an OS Command Injection in a Popular SaaS Platform

projectblack.io | research | #web-security | #vulnerability | #penetration-testing | #education | #saas | #os-command-injection
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

A black-box test of a niche SaaS platform used in Australian schools found OS command injection in the login page's username field, confirmed via a 30-second ping delay — underscoring vendor risk.
Published
Collected

Related coverage

blog · netspi.com
Pentesting the Cloud
After a dull conference, the author concludes cloud pentesting is fundamentally the same as traditional testing: virtualized or shared, the underlying technology and security controls hardly change.
research · blog.trailofbits.com
Trail of Bits Releases Capture the Flag Field Guide
Trail of Bits releases the free CTF Field Guide, self-guided coursework from Dan Guido's NYU-Poly course and DARPA training material, to help students build skills and form Capture the Flag teams.
research · hackerone.com
Jedox’s Journey with HackerOne: A Q&A with CTO, Vladislav Maličević
Jedox CTO Vladislav Maličević describes moving from HackerOne pentests to a managed private bug bounty in 2021, and how continuous hacker testing strengthens security for its EPM platform.
research · hackenproof.com
How to Read Any Smart Contract Project Without Getting Lost
A methodology guide on reading unfamiliar smart contract projects without getting lost, aimed at security researchers and auditors facing large, complex codebases.
research · github.com
Infinity Core: Linux Kernel Core Subsystems LPE and Container Escape Research
Unlike most modern Linux kernel exploits that depend on networking, eBPF, or unprivileged user namespaces, these vulnerabilities reside in fundamental kernel core subsystems, rendering standard container sandboxes and Android application domain restrictions ineffective against local privilege escalation.
research · vercel.com
DeepsecBench: evaluating model performance in finding cybersecurity vulnerabilities
Today we're releasing DeepsecBench, a benchmark that evaluates how well different models find security vulnerabilities in application code.
Back