PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Por trás da falha: Erro de Lógica no Parser de Sessão do Roundcube [CVE-2025-49113]

yokai.hakaisecurity.io | vulnerability | CVE-2025-49113 | #vulnerability-research | #research
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Recentemente, foi descoberta uma vulnerabilidade no serviço de webmail Roundcube que permite a um usuário autenticado obter execução remota de comandos no servidor. A falha foi identificada pelo pesquisador Kirill Firsov e reportada em 2 de junho de 2025. Detalhes da vulnerabilidade Resumidamente, a falha ocorre devido a um erro de lógica em um analisador […]
CVE
CVE-2025-49113
Published
Collected

Related coverage

vulnerability · yokai.hakaisecurity.io
Behind the Bug: Logic Error in Roundcube Session Parser [CVE-2025-49113]
Recently, a vulnerability was discovered in the Roundcube webmail service that allows an authenticated user to obtain remote execution of commands on the server. The flaw was identified by researcher Kirill Firsov and reported on June 2, 2025. Vulnerability details In short, the flaw occurs due to a logic error in asession parser implemented by […]
vulnerability · yokai.hakaisecurity.io
OsCommerce v4 RCE: Unveiling the file upload bypass threat
In my recent research, I identified a critical vulnerability in osCommerce v4, specifically a Remote Code Execution (RCE) vulnerability enabled by bypassing file upload restrictions. I’ve always enjoyed testing file upload bypass techniques in my assessments. Vulnerabilities Identified in OsCommerce Version 4 The CVE-2024-22724 was assigned to the discovery of this vulnerability. The issue […]
vulnerability · yokai.hakaisecurity.io
Fortigate - Autenticação de Desvio Levando à Assunção Completa do Dispositivo
Pesquisa de vulnerabilidade 1Day pela Equipe de Pesquisa da Hakai Este post trata da jornada para criar uma Prova de Conceito sobre a CVE-2022-40684, esta vulnerabilidade foi atribuída pela Fortinet como uma falha de autenticação usando uma vulnerabilidade de caminho ou canal alternativo [CWE-288]. Linha do Tempo 07/10/2022 – Primeira notícia sobre a vulnerabilidade, […]
vulnerability · yokai.hakaisecurity.io
Windows Admin-to-Kernel Elevation of Privilege (CVE-2024-21338)
On February 13th, 2024, Microsoft disclosed the CVE-2024-21338 based on the security report which allows for read/write in the kernel memory.
vulnerability · yokai.hakaisecurity.io
GLPI - SQL injection through dynamic reports
This post details the journey of our Research Team in uncovering a SQL Injection vulnerability in GLPI, an open-source ITSM tool predominantly used in Brazil and France. We observed many companies using GLPI, and we decided to focus on finding vulnerabilities that could allow access to users’ credentials and potentially some Remote Code Execution (RCE) […]
vulnerability · yokai.hakaisecurity.io
Fortigate - Authentication Bypass Lead to Full Device Takeover
1Day vulnerability research by Hakai – Research Team This post is about the journey to create a Proof-of-concept about CVE-2022-40684, this vulnerability has been assigned by Fortinet as an authentication bypass using an alternate path or channel vulnerability [CWE-288]. Timeline 07/10/2022 – First news about the vulnerability, on 10/07/2022 Gi7w0rm tweeted that Fortinet was […]
Back