~/research/notes

Sqli

3 posts

2026

  1. writeup 7 min read

    phpIPAM 1.7.4 - Second Order SQL Injection via subnetOrdering

    Second Order SQL Injection in phpIPAM 1.7.4 (CVE-2026-4189) Back in 2022, I found a SQL injection in phpIPAM 1.4.4 (CVE-2022-23046) via the BGP mapping search feature. That was a …

2025

  1. mobile 3 min read

    Flipcoin Wallet Mobile Hacking Lab

    Flipcoin Wallet CTF - SQL Injection Challenge In this CTF challenge, I'll explore a SQL Injection vulnerability ( Client Side) in the Flipcoin Wallet iOS app. I'll walk you through …

2023

  1. writeup 6 min read

    PHPIPAM CVE

    TL;DR This write up is about a SQL injection which I found 4 days after another researcher reported it :/, however, because of the fact that I haven’t found any write ups or …