Ayoub ELMOKHTAR

CVE-2024-34716 – The Deceptive PNG Trap: Breaking Down the PNG-Driven Chain from XSS to Remote Code Execution on PrestaShop (<=8.1.5)

April 12, 20247 min read

If you’re unfamiliar with PrestaShop (https://github.com/PrestaShop/PrestaShop), think of it as a comprehensive toolbox designed for creating an online store. This platform enables you to construct your storefront, display your merchandise,...

CVE-2024-3116 – Remote Code Execution Vulnerability in pgAdmin - PostgreSQL Tools (<=8.4): Detailed Analysis Report

March 31, 20246 min read

The following write-up guides you through the discovery of a critical Remote Code Execution (RCE) vulnerability in pgAdmin (<=8.4) a widely used administrative tool for PostgreSQL databases, which presents a...

CVE-2020-9915 – Failure to properly process form-action ‘self’ leads to CSP bypass in Safari

September 18, 20212 min read

Content Security Policy (CSP) is an added security layer that helps detect and mitigate specific attacks, including Cross-Site Scripting (XSS) and data injection attacks. These attacks are used for everything...

I could’ve deleted all SMC messages. using Brute Force Technique – PayPal

April 23, 20184 min read

While playing around with the SMC platform at paypal.com, I came across an interesting endpoint that doesn’t include a CSRF token within its request when you delete a message. Cross-Site...