PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Loose Types Sink Ships: Pre-Authentication SQL Injection in Halo ITSM

slcyber.io | research | #vulnerability-research | #sql-injection
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Assetnote discovers a pre-authentication SQL injection vulnerability in Halo ITSM, exploitable due to loose type handling in the codebase.
Published
Collected

Related coverage

vulnerability · horizon3.ai
[CVE-2021-41765] Multiple Vulnerabilities in ResourceSpace
Advisory for CVE-2021-41765, a critical SQL injection vulnerability leading to remote code execution, by the Horizon3 red team.
vulnerability · horizon3.ai
CVE-2020-35700: Exploiting a Second-Order SQL Injection in LibreNMS < 21.1.0
# CVE-2020-35700: Exploiting a Second-Order SQL Injection in LibreNMS * * * ##### How can NodeZero help you? Let our experts walk you through a demonstration of NodeZero®, so you can see how to...
vulnerability · horizon3.ai
CVE-2020-29437: Authenticated SQL Injection in OrangeHRM < 4.6.0.1
OrangeHRM is software for Human Resource Management (HRM). In a routine audit of the open source version of OrangeHRM, we discovered a SQL injection…
research · slcyber.io
How practical is 100k requests per second? Introducing h3fuzz
Can HTTP/3 really give you 100k requests per second for content discovery? We tested it in a fork of ffuf and are releasing h3fuzz, a web UI for fuzzing.
research · slcyber.io
More Critical Bugs in Adobe Experience Manager: Pre-Auth RCE
Chaining an unauthenticated bulk import, an in-band XXE, leaked IMS credentials and Groovy execution into full pre-auth RCE on Adobe Experience Manager Cloud.
research · slcyber.io
Leaking the Keys to the Kingdom: How a Single Slip Handed Over a Darknet Empire
# Leaking the Keys to the Kingdom: How a Single Slip Handed Over a Darknet Empire Get research alerts Share on social October 8, 2026 9 min read ### Table of Contents TOC Element The Sequence of...
Back