Researched and written by: Caio Burgardt and Silton Santos This is a write-up of CVE-2022–36635: SQLInjection found in a platform of physical security (access control, elevator control, guest management, patrol and parking management) called ZKSecurity Bio v4.1.3 and how it was used to obtain a RCE. How it all began… It was a Thursday…

Hello everyone, it’s nothing new that Cloud environments have been dominating the market today, and among service providers, AWS is on the rise. I’ve decided to write this brief article on hunting low-hanging fruits in applications at AWS environments, talk a little bit about the granularity of a security policy…

Hi there! A few days ago I was studying about the CLSID, or Class ID, and I’ve found something interesting! A bypass in the Avast Sandbox feature, using CLSIDs. I’ll give a brief description of what I’ve learnt at this little journey. What is a CLSID and a COM Class…

That’s my first blog post in Stolabs, and I would like to share with you a bug that I found in the Avast Sandbox, allowing a denial of service (DoS) attack against the protection service. For those who don’t know, Avast has a security suite called Avast Premium Security, including…