• Ten Years Later, A2Billing Still Had a Few Surprises

    advisories / static analysis

    I returned to A2Billing a decade after writing about it and found pre-auth SQL injection and an authenticated code-execution chain. Here is how the research unfolded.