~/research/mcpmanagementservice-seimpersonate-system.md
own-lab technique research: a dcom activation-with-storage primitive — the
objref-in-Stat trick — turns SeImpersonatePrivilege into
NT AUTHORITY\SYSTEM. validated on server 2022, server 2025 and windows 11 25h2,
cold-start and session 0 included. write-up in english — versão pt-br ↗.
- vendor=microsoft
- os=windows
- primitive=objref-in-stat
- lang=en
~/research/prestashop-admin-api-scope-privesc.md
an api client holding only api_client_write can self-grant broader scopes through
the api-clients endpoint — the command never checks who delegated what, and scope finalization
honors the rewritten list. from module_write it's one archive upload to code exec.
no admin session needed.
- vendor=prestashop
- product=9.0.0–9.2.0
- --cvss=8.8
- --cwe=269
- id=reserved (cve pending)
- fixed_in=none yet
~/research/opencart-api-case-confusion.md
route matching is case-sensitive at the auth guard and case-insensitive at the router.
request /api/v1/users/PASSWORDRESET instead of the canonical path and the guard never
fires. chain it with the password reset flow and you take over any user account with zero
credentials — the admin panel is not in reach, the advisory is explicit about that.
ghsa drafted, not filed yet; no vendor response on file.
- vendor=opencart
- product=4.1.x
- --cvss=9.8
- --cwe=178
- --cwe=287
- id=ghsa (draft)
~/research/octobercms-safemode-sandbox-rce.md
bypass of the fix for cve-2026-22692: a nested callable slips through the safe-mode sandbox
via SafeCollection and lands in rce territory. patched in 4.2.25, tracked by the
vendor as ghsa-8rgj-g632-3qfp with researcher credit.
- vendor=octobercms
- product=< 4.2.25
- --severity=high
- --cwe=94
- id=ghsa-8rgj-g632-3qfp
- fixed=4.2.25