ADMIN.FOUNDATION

  • PgAdmin Vulnerability Lets Attackers Gain Unauthorised Account Access

    ·

    , ,

    A significant security flaw has been discovered in pgAdmin, the widely used open-source administration and development platform for PostgreSQL databases.

    The vulnerability, tracked as CVE-2025-9636, affects all pgAdmin versions up to and including 9.7, potentially allowing remote attackers to gain unauthorized access to user accounts and the sensitive data they manage.

    The core of the issue lies in an improperly configured Cross-Origin Opener Policy (COOP). This security feature is designed to isolate a web application’s window from other windows, preventing malicious pages from interacting with it.

    In affected pgAdmin versions, this policy was not enforced correctly, creating an opening for attackers to manipulate the OAuth authentication flow.

    OAuth is a standard protocol used for secure authorization, often seen in “Log in with Google” or “Log in with GitHub” functionalities.

    PgAdmin Vulnerability Exploited

    An attacker could exploit this vulnerability by tricking a user into clicking a specially crafted link. This link would open the pgAdmin login page in a new browser window while the attacker’s malicious page remains active in the original window.

    Due to the COOP misconfiguration, the attacker’s page can maintain a reference to the pgAdmin window and interfere with the authentication process.

    If the user then proceeds to log in using an OAuth provider, the attacker can intercept the authentication token, effectively hijacking the session.

    The successful exploitation of this flaw carries severe risks for organizations and their data. The primary consequences include:

    • Unauthorised Account Access: An attacker can gain control of a legitimate user’s pgAdmin session, granting them the same level of access as the victim.
    • Data Breaches: Once inside, an attacker can view, modify, or exfiltrate sensitive information from any PostgreSQL databases connected to the compromised pgAdmin instance.
    • Account Takeover: The vulnerability could be leveraged to perform a full account takeover, locking the legitimate user out.
    • Privilege Escalation: If the hijacked account has administrative privileges, the attacker could potentially escalate their access within the database or even the underlying server infrastructure.

    Mitigations

    The pgAdmin development team has swiftly responded to the issue. A patch has been released that corrects the COOP header configuration, closing the security gap.

    The fix is detailed in a commit on the project’s official GitHub repository. All users of pgAdmin versions 9.7 and earlier are strongly urged to update to the latest version immediately to protect their systems from potential attacks.

    Administrators should prioritize applying this update to all pgAdmin instances within their environments to prevent unauthorized access and safeguard their database assets.

    Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant Updates.

    The post PgAdmin Vulnerability Lets Attackers Gain Unauthorised Account Access appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • PoC Exploit Released for ImageMagick RCE Vulnerability – Update Now

    ·

    , , , ,

    A proof-of-concept (PoC) exploit has been released for a critical remote code execution (RCE) vulnerability in ImageMagick 7’s MagickCore subsystem, specifically affecting the blob I/O (BlobStream) implementation.

    Security researchers and the ImageMagick team urge all users and organizations to update immediately to prevent exploitation.

    ImageMagick, a widely used image processing library, was found to contain a heap out-of-bounds write flaw in its SeekBlob() and WriteBlob() functions within the MagickCore/blob.c component.

    This vulnerability, tracked as CVE-2025-57807 and rated CVSS 9.8 (Critical), allows attackers to corrupt memory and reliably execute arbitrary code under certain conditions.

    The flaw lies in the handling of forward seeks in memory-backed blobs: seeking beyond the end of the buffer allows the subsequent write to overrun the buffer and corrupt the heap, with attacker-controlled data written at attacker-chosen offsets.

    Exploit and Impact

    • The root cause is a contract mismatch between SeekBlob() (which advances the offset) and WriteBlob() (which fails to allocate sufficient memory for later writes far from the buffer’s end). This makes exploits reliable when a forward seek is performed prior to writing data.
    • The issue affects ImageMagick 7.1.2-0 and 7.1.2-1 (and possibly other versions with similar logic), and is architecture-agnostic on LP64 systems.
    • Easy reachability of the bug means even third-party or custom encode-to-memory workflows may inadvertently introduce exploit paths.

    Security researcher Lumina Mescuwa released a working proof-of-concept exploit demonstrating memory corruption following a forward seek well past the buffer’s end, followed by a write.

    This provides an attacker a strong primitive for remote code execution, as heap corruption can be leveraged for process takeover or denial of service. The exploit does not require special delegates, policy changes, or arithmetic wraparounds.

    Given ImageMagick’s use in web services and cloud pipelines, unsanitized workloads may allow attackers to run code remotely by simply uploading a crafted image.

    Organizations using ImageMagick for image handling are at high risk if external images are processed without strict isolation.

    Mitigations

    The ImageMagick project has released patches closing this vulnerability, with 7.1.2-3 (7.x) and 6.9.13-29 (6.x) as the first safe releases.

    The fix ensures that all writes are preceded by buffer expansion to meet the actual offset plus length, eliminating the out-of-bounds write. All users should:

    • Upgrade ImageMagick immediately to the patched versions.
    • Audit deployments and ensure no legacy builds remain in production.
    • Consider hardening downstream processing to detect suspicious seeks and file writes.

    Security teams worldwide are monitoring for exploit attempts. With the release of a public PoC, prompt action is essential for all environments relying on ImageMagick.

    Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant Updates.

    The post PoC Exploit Released for ImageMagick RCE Vulnerability – Update Now appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • PgAdmin Vulnerability Allows Attackers to Gain Unauthorized Account Access

    ·

    , , ,

    A newly disclosed security flaw in pgAdmin4, the widely used open-source tool for managing PostgreSQL databases, has raised serious concerns among developers and database administrators across the world. The vulnerability, tracked as CVE-2025-9636, was recently highlighted in the GitHub Advisory Database and classified as High severity. The issue lies in a Cross-Origin Opener Policy (COOP) vulnerability that affects versions of […]

    The post PgAdmin Vulnerability Allows Attackers to Gain Unauthorized Account Access appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Web Application Firewall Bypassed via JS Injection with Parameter Pollution

    ·

    , , , ,

    In a recent autonomous penetration test, a novel cross-site scripting (XSS) bypass that sidesteps even highly restrictive Web Application Firewalls (WAFs). Security researchers uncovered a ASP.NET application protected by a rigorously configured WAF. Conventional XSS payloads—breaking out of single-quoted JavaScript strings—were promptly blocked. Yet by abusing HTTP parameter pollution, the team managed to split malicious […]

    The post Web Application Firewall Bypassed via JS Injection with Parameter Pollution appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • ⚡ Weekly Recap: Drift Breach Chaos, Zero-Days Active, Patch Warnings, Smarter Threats & More

    ·

    Cybersecurity never slows down. Every week brings new threats, new vulnerabilities, and new lessons for defenders. For security and IT teams, the challenge is not just keeping up with the news—it’s knowing which risks matter most right now. That’s what this digest is here for: a clear, simple briefing to help you focus where it counts. This week, one story stands out above the rest: the

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Salesloft Drift Cyberattack Linked to GitHub Compromise and OAuth Token Theft

    ·

    , , ,

    A sophisticated supply-chain attack that impacted over 700 organizations, including major cybersecurity firms, has been traced back to a compromise of Salesloft’s GitHub account that began as early as March 2025.

    In an update on September 6, 2025, Salesloft confirmed that an investigation by cybersecurity firm Mandiant found that threat actors leveraged this initial access to eventually steal OAuth authentication tokens from its Drift chat platform, leading to widespread data theft from customer systems.

    The investigation, which began on August 28, revealed that threat actors had access to Salesloft’s GitHub account from March through June 2025.

    During this period, the attackers downloaded content from private repositories, added a guest user, and established workflows while conducting reconnaissance on both the Salesloft and Drift application environments.

    While the Salesloft platform itself was not breached, the attackers pivoted to Drift’s AWS environment, where they successfully obtained OAuth tokens for customer technology integrations.

    Salesloft Drift Cyberattack

    The threat actor, identified by Google’s Threat Intelligence Group as UNC6395, used these stolen tokens between August 8 and August 18 to access and exfiltrate data from customers’ integrated applications, most notably Salesforce instances.

    The stolen data primarily included business contact information, such as names, email addresses, and job titles, as well as content from support cases.

    The breach affected a wide array of high-profile companies, including Cloudflare, Zscaler, Palo Alto Networks, PagerDuty, and SpyCloud.

    The incident is considered one of the largest recent SaaS supply-chain attacks, highlighting the risks associated with third-party application integrations.

    In response to the attack, Salesloft engaged Mandiant and took decisive action to contain the threat. The company took the Drift platform completely offline, isolated its infrastructure, and rotated all impacted credentials.

    Mandiant has since verified that the incident is contained and that the technical segmentation between the Salesloft and Drift environments prevented the attackers from moving laterally.

    The focus of the investigation has now shifted to a forensic quality assurance review. Salesloft has issued guidance to its partners, recommending that all third-party applications integrated with Drift via API key proactively revoke the existing key.

    The company also published a list of Indicators of Compromise (IOCs), including malicious IP addresses and user-agent strings, to help customers search their own logs for suspicious activity.

    Indicator TypeValue/Description
    Malicious IP AddressesAny successfully authenticated Drift connections from IPs not on Drift’s official whitelist should be considered suspicious. The following IPs are confirmed as malicious [user-provided text]:
    – 154.41.95.2
    – 176.65.149.100
    – 179.43.159.198
    – 185.130.47.58
    – 185.207.107.130
    – 185.220.101.133
    – 185.220.101.143
    – 185.220.101.164
    – 185.220.101.167
    – 185.220.101.169
    – 185.220.101.180
    – 185.220.101.185
    – 185.220.101.33
    – 192.42.116.179
    – 192.42.116.20
    – 194.15.36.117
    – 195.47.238.178
    – 195.47.238.83
    – 208.68.36.90
    – 44.215.108.109
    Malicious User-Agent StringsThe following user-agent strings have been associated with the threat actor’s activity [user-provided text]:
    – python-requests/2.32.4
    – Salesforce-Multi-Org-Fetcher/1.0
    – Python/3.11 aiohttp/3.12.15

    While a group called “Scattered LAPSUS$ Hunters 4.0” claimed responsibility, investigators have not found credible evidence to support this claim.

    Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant Updates.

    The post Salesloft Drift Cyberattack Linked to GitHub Compromise and OAuth Token Theft appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • You Didn’t Get Phished — You Onboarded the Attacker

    ·

    When Attackers Get Hired: Today’s New Identity Crisis What if the star engineer you just hired isn’t actually an employee, but an attacker in disguise? This isn’t phishing; it’s infiltration by onboarding. Meet “Jordan from Colorado,” who has a strong resume, convincing references, a clean background check, even a digital footprint that checks out. On day one, Jordan logs into email and attends

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • U.S. Officials Investigating Cyber Threat Aimed at China Trade Talks

    ·

    ,

    According to the Wall Street Journal, the deceptive message, purporting to come from Representative John Moolenaar, was dispatched in July to multiple U.S. trade groups, prominent law firms and government agencies. WASHINGTON, Sept. 7 (Reuters) – U.S. authorities have launched an investigation into a sophisticated malware-laden email that appears to have been crafted to glean […]

    The post U.S. Officials Investigating Cyber Threat Aimed at China Trade Talks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Microsoft Azure Cloud Disrupted by Undersea Cable Cuts in Red Sea

    ·

    ,

    Microsoft’s Azure cloud platform is facing significant disruptions after multiple undersea fiber optic cables were severed in the Red Sea.

    The US technology giant confirmed that users would experience delays and increased latency for services relying on internet traffic moving through the Middle East, although it has successfully rerouted data to prevent a complete outage.

    The company stated that the issue began at approximately 05:45 UTC on Saturday, September 6. In a status update, Microsoft explained, “Network traffic traversing through the Middle East may experience increased latency due to undersea fiber cuts in the Red Sea.”

    It assured customers that service was not interrupted, as traffic was immediately redirected through alternate network paths.

    However, the company warned, “We do expect higher latency on some traffic that previously traversed through the Middle East.” Microsoft did not provide any details regarding the cause of the cable damage.

    The Impact of Latency

    For businesses and users relying on Azure, increased latency translates to slower response times for applications, websites, and data access.

    While not a full-scale outage, these delays can impact performance-sensitive operations, such as financial transactions, real-time data processing, and cloud-hosted services that require near-instantaneous communication.

    The rerouting of data, while a critical mitigation step, means information must travel a longer, less direct path to its destination, creating a noticeable lag for affected users in various regions.

    The Red Sea serves as a vital and heavily trafficked corridor for global internet connectivity, linking Europe, Asia, and Africa

    A significant portion of the world’s internet data passes through the subsea cables laid on its seabed. Damage in this narrow channel can have a disproportionately large impact on international connectivity.

    This incident follows other reports from the weekend suggesting that the cable cuts had already affected internet services in the United Arab Emirates and parts of Asia, indicating a potentially widespread problem affecting multiple telecommunication providers.

    Microsoft confirmed that network traffic not routed through the Middle East remains completely unaffected by the incident.

    The company is continuing to monitor the situation closely and has promised to provide daily updates to its customers, with the last communication being logged at 19:52 UTC on September 7.

    The focus remains on managing network performance via the alternate routes while awaiting further information on the complex and costly process of repairing the damaged deep-sea infrastructure. The cause of the cuts is still under investigation.

    Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant Updates.

    The post Microsoft Azure Cloud Disrupted by Undersea Cable Cuts in Red Sea appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • How Microsoft Azure Storage Logs Help Investigate Security Breaches

    ·

    , , ,

    When a security breach occurs, vital evidence often appears in unexpected places. One such source is Microsoft Azure Storage logs, which play a critical role in digital forensics. While storage accounts are often overlooked, enabling and analyzing their logs can help investigators detect unauthorized access, trace attacker activity, and protect sensitive data. Azure Storage Accounts are […]

    The post How Microsoft Azure Storage Logs Help Investigate Security Breaches appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶