ʞʞıdɐɔoɥƆ
Security Researcher & Exploit Developer
at VulnCheck
Breaking, building, and documenting. Vulnerability research, exploit development, and offensive security.
✦ Latest
Xorbits Xoscar: Unauthenticated RCE via Cloudpickle Deserialization in the Actor Pool
VulnCheck's Initial Access Intelligence team details an unauthenticated remote code execution in Xoscar, the actor and RPC framework behind the Xinference inference stack, where the actor pool deserializes every inbound TCP message with cloudpickle before it checks the message type and with no authentication.
Read articleRecent
all →SPIP odt2spip Plugin: Authenticated Command Injection via Uploaded Document Filename
VulnCheck's Initial Access Intelligence team details an authenticated OS command injection in the SPIP odt2spip plugin, where an uploaded document's filename is concatenated into a shell command and run, giving any low-privileged author remote code execution as the web server user.
JCTables for Joomla: When "Already Escaped" Means Injectable
VulnCheck's Initial Access Intelligence team details an unauthenticated JSON CRUD API in the JCTables component for Joomla whose escape helper trusts any value already wrapped in single quotes, turning one URL into arbitrary SQL read and write and, through a borrowed admin session, into remote code execution.
Virtualizor: The Login Parameter That Skips the Login
VulnCheck's Initial Access Intelligence team details an unauthenticated remote root RCE in the Virtualizor admin panel, where the pre-auth billing-module hook is guarded only against requests whose act is not 'login', so act=login walks straight into it, the hook unserializes an attacker POST field and splices its uid into a root shell, and the parameterized queries do not help because MySQL casts the injected string back to the integer the query expects.
FileRun: Four More Ways to Run Your Files
Four authenticated RCEs in FileRun. A contact-sheet handler and a settings test endpoint run attacker input through a shell, and a delegated administrator turns a control-panel field into stacked SQL that a permission-blob deserialization weaponizes into a webshell. All fixed in 2026.3.0.
Inside BitAIM+: Reverse Engineering a Commercial Carrom Pool Cheat
A commercial Android cheat sells itself as an AI aim assistant for Carrom Pool. I pulled it apart: a rebranded VirtualApp container, YAHFA inline hooking, five hook plugins hidden as plaintext base64 inside a native library, a hand-written devirtualization of Google's PairIP protection, direct memory reads into the game's physics engine, and a paywall whose two tiers are hardcoded constructor calls. There is no AI anywhere. There is not even a physics simulation.
FileRun: When Your File Manager Runs Your Files
OS Command Injection in FileRun's thumbnail generation - authenticated (CVSS v4 8.7) or via public 'file request' weblinks (CVSS v4 9.2). The extractors wrap file paths in double quotes and pass them to exec(), but the filename sanitizer allows $(){}` - enough for command substitution. The weblink path uploads a malicious filename via anonymous upload, then self-triggers thumbnail generation through the public listing.
NEVER GONNA
GIVE YOU UP
You were warned.