Blog
All posts
Multiple Stored XSS Vulnerabilities in Codeastro Hospital Management System
Several admin and doctor endpoints write unvalidated POST input straight to the database and render it back, giving stored XSS across the panel.
- appsec
- web
- php
- zero-day
Authenticated File Upload to RCE in Codeastro Hospital Management System
The upload at /his_doc_update-account.php never checks what it is given, so a .php file lands in the webroot and runs.
- appsec
- web
- php
- zero-day
Authenticated SQL Injection in Codeastro Real Estate MS (CVE-2024-11058)
The id parameter on aboutedit.php is concatenated into an UPDATE statement with no sanitisation, letting an authenticated admin rewrite the query.
- appsec
- web
- php
- zero-day
Authenticated File Upload to RCE in Codeastro Real Estate MS
Both aboutadd.php and aboutedit.php accept uploads without validating type or content, so a PHP reverse shell disguised as an image gives remote code execution. CVE-2024-10999 and CVE-2024-11000.
- appsec
- web
- php
- zero-day
Time-Based SQL Injection in Content Management System (CVE-2024-10758)
The login form in index.php drops the username straight into an SQL query, so a payload as simple as ' OR sleep(10)# is enough to confirm injection.
- appsec
- web
- php
- zero-day