Safety warning: PHP zip component integer overflow remote command execution-vulnerability warning-the black bar safety net

2016-05-0900:00:00

佚名

www.myhack58.com

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.344 Low

EPSS

Percentile

96.7%

A, detailed description:
In PHP 7 is due. x versions, which php
Vulnerability report at 3. 2 9 has been submitted to the vulnerability to official
!
4. 2 8, official released 7. 0. 6 version fixes the vulnerability, while the author in github released the exp
!
Second, the problem of proof:
!
References
https://github.com/dyntopia/exploits/blob/master/CVE-2016-3078
https://bugs.php.net/bug.php?id=71923
https://nosec.org/my/threats/1238