CVE-2007-1649

CVE-2007-1649 affects PHP 5.2.1, where context-dependent attackers can read portions of heap memory by executing certain scripts with a serialized data input string starting with S:, due to improper tracking of input bytes. This VUL is documented across multiple sources (SUSE, Red Hat, Mandriva a...

PHP 5.2.1 - 'Unserialize()' Local Information Leak

1,strrepeat'"', 200."2"=1; $heapdump = unserialize$str; echo "Heapdump\n---------\n\n"; $len = strlen$heapdump; for $b=0; $b$len; $b+=16 printf"%08x: ", $b; for $i=0; $i16; $i++ if $b+$i$len printf "%02x ", ord$heapdump$b+$i; else printf ".. "; for $i=0; $i16; $i++ if $b+$i$l...

CVE-2007-1582

The resource system in PHP 4.0.0 through 4.4.6 and 5.0.0 through 5.2.1 allows context-dependent attackers to execute arbitrary code by interrupting certain functions in the GD ext/gd extension and unspecified other extensions via a userspace error handler, which can be used to destroy and modify...

Code injection

The resource system in PHP 5.0.0 through 5.2.1 allows context-dependent attackers to execute arbitrary code by interrupting the hashupdatefile function via a userspace 1 error or 2 stream handler, which can then be used to destroy and modify internal resources. NOTE: it was later reported that PH...

PHP 4.4.6/5.2.1 - ext/gd Already Freed Resources Usage

?php //////////////////////////////////////////////////////////////////////// // // // | || | | | | | | | || || \ // // | |/ || '|/ |/ -| ' \ / -/ |||| /| || / // // ||||,||| ,|||||||,| || |||||| // // // // Proof of concept code from the Hardened-PHP Project // // C Copyright 2007 Stefan...

PHP 5.2.1 - hash_update_file() Freed Resource Usage

PHP 5.2.1 - hashupdatefile Freed Resource Usage ?php //////////////////////////////////////////////////////////////////////// // // // | || | | | | | | | || || \ // // | |/ || '|/ |/ -| ' \ / -/ |||| /| || / // // ||||,||| ,|||||||,| || |||||| // // // // Proof of concept code from the...

PHP <= 4.4.6 / 5.2.1 array_user_key_compare() ZVAL dtor Local Exploit

Exploit for linux platform in category local exploits ===================================================================== PHP = 4.4.6 / 5.2.1 arrayuserkeycompare ZVAL dtor Local Exploit ===================================================================== ?php...

PHP 5.2.0/5.2.1 Rejected Session ID Double Free Exploit

Exploit for linux platform in category local exploits ======================================================= PHP 5.2.0/5.2.1 Rejected Session ID Double Free Exploit ======================================================= ?php //////////////////////////////////////////////////////////////////////...

CVE-2007-1399

Stack-based buffer overflow in the zip:// URL wrapper in PECL ZIP 1.8.3 and earlier, as bundled with PHP 5.2.0 and 5.2.1, allows remote attackers to execute arbitrary code via a long zip:// URL, as demonstrated by actively triggering URL access from a remote PHP interpreter via avatar upload or...

Stack overflow

Stack-based buffer overflow in the zip:// URL wrapper in PECL ZIP 1.8.3 and earlier, as bundled with PHP 5.2.0 and 5.2.1, allows remote attackers to execute arbitrary code via a long zip:// URL, as demonstrated by actively triggering URL access from a remote PHP interpreter via avatar upload or...

PHP import_request_variables()函数任意变量覆盖漏洞

PHP是广泛使用的通用目的脚本语言，特别适合于Web开发，可嵌入到HTML中。 PHP的importrequestvariables函数实现上存在漏洞，远程攻击者可能利用此漏洞控制服务器。 远程攻击者可以利用PHP的importrequestvariables函数覆盖$和$变量（任意php变量），导致执行任意代码。有漏洞代码位于以下文件中： ./ext/standard/basicfunctions.c:PHPFUNCTIONimportrequestvariables ./Zend/zendhash.c:ZENDAPI void...

PT-2007-2793

Name of the Vulnerable Software and Affected Versions PECL ZIP versions 1.8.3 and earlier PHP versions 5.2.0 and 5.2.1 Description The issue is a stack-based buffer overflow in the zip:// URL wrapper. This allows remote attackers to execute arbitrary code via a long zip:// URL. Attackers can...

PHP import_request_variables&#40;&#41; arbitrary variable overwrite

PHP importrequestvariables arbitrary variable overwrite Name Using importrequestvariables you can overwrite $ and $ any php variable. Systems Affected PHP =4.0.7 =5.2.1 Severity High Vendor http://www.php.net/ Advisory http://www.wisec.it/vulns.php?id=10 http://www.wisec.it/vuln10.txt Authors...

Php Nuke POST XSS on steroids

Php Nuke POST XSS on steroids Name Php Nuke POST XSS on steroids Systems Affected PHP =4.0.7 =5.2.1, GLOBALS OFF, Php Nuke 8.0 and others partially verified Severity Medium Vendor http://php nuke.org/ Advisory http://www.ush.it/2007/03/09/php-nuke-wild-post-xss/ Authors Francesco ascii Ongaro...

PHP 5.2.1 - 'substr_compare()' Information Leak

?php //////////////////////////////////////////////////////////////////////// // // // | || | | | | | | | || || \ // // | |/ || '|/ |/ -| ' \ / -/ |||| /| || / // // ||||,||| ,|||||||,| || |||||| // // // // Proof of concept code from the Hardened-PHP Project // // C Copyright 2007 Stefan...

PHP <= 5.2.1 substr_compare() Information Leak Exploit

Exploit for multiple platform in category local exploits ====================================================== PHP = 5.2.1 substrcompare Information Leak Exploit ====================================================== ?php //////////////////////////////////////////////////////////////////////// /...

PHP &lt;= 5.2.1 substr_compare() Information Leak Exploit

No description provided by source. ?php //////////////////////////////////////////////////////////////////////// // // // | || | | | | | | | || || \ // // | |/ || '|/ |/ -| ' \ / -/ |||| /| || / // // ||||,||| ,|||||||,| || |||||| // // // // Proof of concept code from the Hardened-PHP...

PHP < 4.4.5 / 5.2.1 (shmop Functions) Local Code Execution Exploit

Exploit for linux platform in category local exploits ================================================================== PHP 4.4.5 / 5.2.1 shmop Functions Local Code Execution Exploit ================================================================== ?php...

MOPB-10-2007:PHP php_binary Session Deserialization Information Leak Vulnerability

Summary The PHP session extension comes with a serialization handler called 'phpbinary' that is vulnerable to a heap information leak vulnerability. This security hole is the result of a missing boundary check and allows leaking up to 126 bytes following the serialized data into array keys of the...

PHP < 4.4.5 / 5.2.1 php_binary Session Deserialization Information Leak

Exploit for multiple platform in category local exploits ======================================================================= PHP 4.4.5 / 5.2.1 phpbinary Session Deserialization Information Leak ======================================================================= ?php...