CVE-2021-29447

CVE-2021-29447 POC pour exploiter l'injection XXE authentifiée dans WordPress 5.6-5.7 PHP 8+. Plus d'informations sur cette CVE ici Exemple Exemple d'utilisation contre la machine MetaTwo de HackTheBox, qui héberge un site WordPress avec une médiathèque vulnérable à l'injection XXE. root@kitploit...

exploit_cve-2021-29447

exploitcve-2021-29447 À des fins éducatives uniquement. Cet exploit est censé être un outil vraiment pratique pour obtenir n'importe quel fichier d'un serveur exécutant WordPress 5.6.2 et php8. voir https://wpscan.com/vulnerability/cbbe6c17-b24e-4be4-8937-c78472a138b5 Tout ce dont vous avez besoi...

CVE-2021-29447

CVE-2021-29447 PoC Этот репозиторий содержит доказательство концепции PoC эксплуатации уязвимости CVE-2021-29447 , затрагивающей WordPress 5.6 и 5.7 с PHP 8. Эксплойт показывает, как атакующий, имея возможность загружать файлы, может использовать уязвимость парсинга XML в Медиатеке, что приводит ...

snuffleupagus

Snuffleupagus Модуль безопасности для php7 и php8 — Уничтожение классов уязвимостей и виртуальное патчирование остального!...

CVE-2021-29447-PoC

CVE-2021-29447 Доказательство концепции root@kitploit: ╔═╗╦ ╦╔═╗ ║ ╚╗╔╝║╣────2021-29447 ╚═╝ ╚╝ ╚═╝ Написано Isa Ebrahim - 0xRar в январе 2023 ═══════════════════════════════════════════════════════════════════════════ Название: Уязвимость XML-парсинга в WordPress Media Library, приводящая к XXE...

snuffleupagus

Snuffleupagus Security module for php7 and php8 - Killing bugclasses and virtual-patching the rest!...

TimeAfterFree

TimeAfterFree إثبات مفهوم PoC للهروب من صندوق الحماية sandbox في PHP 8 يوضح تجاوز disablefunctions على أنظمة تشبه يونكس. يستغل هذا الاستغلال ثغرة استخدام بعد التحرير use-after-free لتجاوز disablefunctions وتنفيذ أوامر النظام. تستخدم تقنيات الاستغلال المستخدمة لتسريب مؤشرات الكومة والحصول على...

EUVD-2023-51635

Malicious code in bioql PyPI...

CVE-2024-4577 Argument Injection in PHP-CGI

In PHP versions 8.1. before 8.1.29, 8.2. before 8.2.20, 8.3. before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may...

SUSE SLES15: apache2-mod_php8 / php8 / php8-bcmath / php8-bz2 / php8-calendar / etc (SUSE-SU-2024:1446-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:1446-1 advisory. - CVE-2024-2756: Fixed bypass of security fix applied for CVE-2022-31629 that lead PHP to consider not secure cookies...

CVE-2024-28859

Symfony1 is a community fork of symfony 1.4 with DIC, form enhancements, latest Swiftmailer, better performance, composer compatible and PHP 8 support. Symfony 1 has a gadget chain due to vulnerable Swift Mailer dependency that would enable an attacker to get remote code execution if a developer...

CVE-2024-28859 Gadget chain in Symfony 1 due to vulnerable Swift Mailer dependency

Symfony1 is a community fork of symfony 1.4 with DIC, form enhancements, latest Swiftmailer, better performance, composer compatible and PHP 8 support. Symfony 1 has a gadget chain due to vulnerable Swift Mailer dependency that would enable an attacker to get remote code execution if a developer...

CVE-2024-28859 Gadget chain in Symfony 1 due to vulnerable Swift Mailer dependency

Symfony1 is a community fork of symfony 1.4 with DIC, form enhancements, latest Swiftmailer, better performance, composer compatible and PHP 8 support. Symfony 1 has a gadget chain due to vulnerable Swift Mailer dependency that would enable an attacker to get remote code execution if a developer...

BIT-WORDPRESS-2021-29447 WordPress Authenticated XXE attack when installation is running PHP 8

Wordpress is an open source CMS. A user with the ability to upload files like an Author can exploit an XML parsing issue in the Media Library leading to XXE attacks. This requires WordPress installation to be using PHP 8. Access to internal files is possible in a successful XXE attack. This has...

BIT-WORDPRESS-MULTISITE-2021-29447 WordPress Authenticated XXE attack when installation is running PHP 8

Wordpress is an open source CMS. A user with the ability to upload files like an Author can exploit an XML parsing issue in the Media Library leading to XXE attacks. This requires WordPress installation to be using PHP 8. Access to internal files is possible in a successful XXE attack. This has...

External Control Of Filename

phenx/php-svg-lib is vulnerable to External Control of Filename. The vulnerability is due to insecure handling of inline CSS font definitions, allowing an attacker to deserialize a PHAR file through the phar:// URL handler. Note that remote code execution is only possible on PHP versions less the...

Insecure Deserialization/Unsafe Attributes Merge

phenx/php-svg-lib is vulnerable to Insecure Deserialization. The vulnerability is caused due to unsafe attributes such as href, xlink:href and id while merging attributes from the tag to the tag when handling a tag that references an tag. This can lead to an unsafe file read that can cause PHAR...

CVE-2023-50252

php-svg-lib is an SVG file parsing / rendering library. Prior to version 0.5.1, when handling tag that references an tag, it merges the attributes from the tag to the tag. The problem pops up especially when the href attribute from the tag has not been sanitized. This can lead to an unsafe file...

CVE-2023-50252 php-svg-lib unsafe attributes merge when parsing `use` tag

php-svg-lib is an SVG file parsing / rendering library. Prior to version 0.5.1, when handling tag that references an tag, it merges the attributes from the tag to the tag. The problem pops up especially when the href attribute from the tag has not been sanitized. This can lead to an unsafe file...

CVE-2023-50252 php-svg-lib unsafe attributes merge when parsing `use` tag

php-svg-lib is an SVG file parsing / rendering library. Prior to version 0.5.1, when handling tag that references an tag, it merges the attributes from the tag to the tag. The problem pops up especially when the href attribute from the tag has not been sanitized. This can lead to an unsafe file...