SKIP TO CONTENT
PIXZ.DEV
05 / RESEARCH — TECHNICAL NOTEBOOK1 ENTRY — MORE LAND AS WORK COMPLETES

Ongoing investigations and technical notes. Entries open as full articles — findings, impact, remediation, ethics — published as they happened.

001
Garuda CBT — Security TeardownA HackerOne-style vulnerability disclosure report against Garuda CBT — an open-source school exam and report-card application built on CodeIgniter 3 — audited entirely on a locally hosted instance built from the public repository. Nine findings, eight verified dynamically: three Critical (unauthenticated admin creation at CVSS 9.8, unauthenticated RCE through installer config injection at 9.9, and arbitrary SQL execution escalating into a full webshell chain at 10.0), three High, two Medium, and one Low/Info. Static review of the de-obfuscated source traced the sinks; a local PHP 8.3 + MariaDB 11.8 bench confirmed every critical claim through dynamic reproduction (reproduction detail redacted from this publication).APPSECPHPCODEIGNITERSQLIRCE
SEPTEMBER 2026VERIFIED — SELF-HOSTED