Command-Injection on Domain Securityhttps://domainsecurity.agency/tags/command-injection/Recent content in Command-Injection on Domain SecurityHugoenFri, 11 Sep 2026 00:00:00 +0000HTB: Previse ยท from a broken PHP redirect to root via command injectionhttps://domainsecurity.agency/posts/htb-previse/Fri, 11 Sep 2026 00:00:00 +0000https://domainsecurity.agency/posts/htb-previse/A retired easy Linux box built entirely around one PHP habit gone wrong: a missing exit() after a login redirect lets an unauthenticated user create an account, source code recovered from an exposed backup reveals a textbook command injection, and a sudo script calling gzip without an absolute path hands over root.