369 matches found
SugarCRM REST Unserialize PHP Code Execution
This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'SugarCRM REST Unserialize PHP Code Execution', 'Description' = %q This module exploits a PHP Object Injection vulnerability in...
SugarCRM 6.5.23 - REST PHP Object Injection (Metasploit)
SugarCRM 6.5.23 - REST PHP Object Injection Metasploit This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'SugarCRM REST Unserialize PHP Code Execution', 'Description' = %q This...
Bomgar Remote Support - Unauthenticated Code Execution (Metasploit)
Exploit for linux platform in category remote exploits This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Bomgar Remote Support Unauthenticated Code Execution', 'Description' = %q Thi...
Bomgar Remote Support - Code Execution (Metasploit)
This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Bomgar Remote Support Unauthenticated Code Execution', 'Description' = %q This module exploits a vulnerability in the Bomgar Remote...
CVE-2015-6836
The SoapClient call method in ext/soap/soap.c in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 does not properly manage headers, which allows remote attackers to execute arbitrary code via crafted serialized data that triggers a "type confusion" in the serializefunctioncall...
PHP process_nested_data 函数释放后重用漏洞
A while ago the function "processnesteddata" was changed to better handle object properties. Before it was possible to create numeric object properties which would cause trouble down the road. So the following code was added: if !objprops ... else / object properties should include no integers /...
Joomla high-risk vulnerability scanning event analysis-vulnerability warning-the black bar safety net
Summary 1 2 on 1 4 May, the Joomla official website emergency issued a due to the security vulnerability to cause a version update 3.4.6, according to security company sucuri released information, this scan time is to use the Joomla deserialization characteristics of the problem causes the...
Google Chrome - Renderer Process to Browser Process Privilege Escalation
Google Chrome - Renderer Process to Browser Process Privilege Escalation Source: https://code.google.com/p/google-security-research/issues/detail?id=664 There is an overflow in the ui::PlatformCursor WebCursor::GetPlatformCursor method. In...
Google Chrome V8 Denial of Service Vulnerability (CNVD-2015-08180)
Google Chrome is the United States Google Google company developed a Web browser. Google V8 is one of the open source JavaScript engine. A security vulnerability exists in the 'BasicJsonStringifier::: SerializeJSArray' function in the json-stringifier.h file in the JSON stringifier of Google V8...
v8: unspecified out-of-bounds access vulnerability
The BasicJsonStringifier::SerializeJSArray function in json-stringifier.h in the JSON stringifier in Google V8, as used in Google Chrome before 47.0.2526.73, improperly loads array elements, which allows remote attackers to cause a denial of service out-of-bounds memory access or possibly have...
[SECURITY] [DLA 341-1] php5 security update
Package : php5 Version : 5.3.3.1-7+squeeze28 CVE ID : CVE-2015-6831 CVE-2015-6832 CVE-2015-6833 CVE-2015-6834 CVE-2015-6836 CVE-2015-6837 CVE-2015-6838 CVE-2015-7803 CVE-2015-7804 CVE-2015-6831 Use after free vulnerability was found in unserialize function. We can create ZVAL and free it via...
By PHP deserialization remote code execution-vulnerability warning-the black bar safety net
In the NotSoSecure, we will conduct penetration testing or code review, but recently we came across an interesting PHP code, which could lead to remote code execution RCE）vulnerabilities, but its use was a bit tricky. Experienced a few trying to crack this Code of sleepless nights, we are convinc...
PHP 'serialize_function_call()' function remote code execution vulnerability
PHP an open source general-purpose computer scripting language. A security vulnerability in the PHP 'serializefunctioncall' function allows remote attackers to submit a special request, execute arbitrary code, or conduct a denial-of-service attack...
PHP 5.6.x < 5.6.12 Multiple Vulnerabilities
According to its banner, the version of PHP running on the remote web server is 5.6.x prior to 5.6.12. It is, therefore, affected by multiple vulnerabilities : - A use-after-free error exists in file spldllist.c due to improper sanitization of input to the unserialize function. An attacker can...
PHPSHE SQL注入
简要描述： 又SQL注入了。 详细说明： WooYun: PHPSHE SQL注入 来看看这个去年的漏洞修复的怎么样了- - peselect'order', array'orderid'=$void; if $info'orderstate' == 'notpay' $order'orderoutid' = $vpmode; $order'orderpayway' = 'ebank'; $order'orderstate' = 'paid'; $order'orderptime' = time; $db-peupdate'order', array'orderid'=$void,...
PHP Core unserialize Function Integer Overflow (CVE-2014-3669)
A code execution vulnerability has been reported in PHP core. The vulnerability is due to an integer overflow within the unserialize function. A remote attacker can exploit the vulnerability by sending crafted serialize data to a web application running a vulnerable version of PHP. A successful...
PHPSHE SQL注入
简要描述： 默认配置验证绕过 详细说明： /include/plugin/payway/ebank/Receive.php中 ebankmd5 默认为空 ，可以生成sign绕过 include'../../../../common.php'; $cachepayway = cache::get'payway'; $payway = unserialize$cachepayway'ebank''paywayconfig'; $key = $payway'ebankmd5'; //默认为空 $void =trim$POST'void'; $vpmode =trim$POST'vpmode';...
CVE-2014-6072: CSRF vulnerability in the Web Profiler
Affected Versions All 2.0.X, 2.1.X, 2.2.X, 2.3.X, 2.4.X, and 2.5.X versions of the Symfony WebProfiler bundle are affected by this security issue. This issue has been fixed in Symfony 2.3.19, 2.4.9, and 2.5.4. Note that no fixes are provided for Symfony 2.0, 2.1, and 2.2 as they are not maintaine...
Fedora 20 : php-5.5.14-1.fc20 (2014-7765)
26 Jun 2014, PHP 5.5.14 Core : - Fixed BC break introduced by patch for bug 67072. Anatol, Stas - Fixed bug 66622 Closures do not correctly capture the late bound class static:: in some cases. Levi Morrison - Fixed bug 67390 insecure temporary file use in the configure script. CVE-2014-3981 Remi ...