Results for http

Threat Research

Easy Hosting Control Panel: SQL Injection & Multiple XSS Vulnerabilities

As part of our ongoing threat research at FortiGuard Labs, we discovered that EHCP contains an SQL Injection and multiple cross-site Scripting (XSS) vulnerabilities.

By Zhouyuan YuangJuly 08, 2018

Threat Research

The Analysis of Apache Struts 1 ActionServlet Validator Bypass (CVE-2016-1182)

Apache Struts 1 ValidatorForm is a commonly used component in the JAVA EE Web Application that requires validated form fields input by a user, such as a login form, registration form, or other information form. By configuring the validation rules, Apache Struts can validate many different kinds of fields - username, email, credit card number, etc. However, a bug in Apache Struts 1 can be used to manipulate the property of ValidatorForm so as to modify the validation rules, or even worse, cause a denial of service or execute arbitrary code in the...

By Dehui YinOctober 25, 2017

Threat Research

The Analysis of Apache Struts 1 Form Field Input Validation Bypass (CVE-2015-0899)

Apache Struts 1 is a popularly used JAVA EE web application framework. It offers many kinds of validators to filter user input by using the Apache Common Validator library, which is both convenient and fast. However, a bug in Apache Struts can be used to easily bypass the input validation process, allowing an attacker to submit arbitrary dirty data to the database, possibly resulting in a cross-site scripting attack when the user views the JSP file that refers directly to the corrupted data.

By Dehui YinOctober 25, 2017