Exploit Repository

Encrypted record of fickling detection-bypass findings — including two accepted High-severity (CVSS 8.8) pickle-safety RCE bypasses with CVEs pending — plus a patched duplicate and a draft. AES-256-GCM, passphrase required to decrypt in-browser; nothing is sent anywhere.

threading.Barrier synchronizes N concurrent POST /api/client/cart/checkout requests so the non-atomic per-client COUNT check passes in all of them before any redemption row is written — one client redeems a once-per-client code on many orders.

Authenticates as admin, injects a passthru() web shell into config.php via set_interface_ip(), then triggers code execution on any subsequent HTTP request. Demonstrates persistent RCE as www-data with no session required after injection.

Single curl command registers a client in an arbitrary client group by supplying group_id in the public registration POST body. Grants immediate access to group-restricted promo codes without any authentication or prior knowledge beyond a valid group ID.

Uses threading.Barrier to synchronize N concurrent checkout requests, maximizing race window overlap. Bypasses single-use or limited-use promo code restrictions — a single-use code yields 10+ successful checkouts in typical testing.