By PHP deserialization remote code execution-vulnerability warning-the black bar safety net

In the NotSoSecure, we will conduct penetration testing or code review, but recently we came across an interesting PHP code, which could lead to remote code execution RCE）vulnerabilities, but its use was a bit tricky. Experienced a few trying to crack this Code of sleepless nights, we are convinc...

PHP 'serialize_function_call()' function remote code execution vulnerability

PHP an open source general-purpose computer scripting language. A security vulnerability in the PHP 'serializefunctioncall' function allows remote attackers to submit a special request, execute arbitrary code, or conduct a denial-of-service attack...

PHP 5.6.x < 5.6.12 Multiple Vulnerabilities

According to its banner, the version of PHP running on the remote web server is 5.6.x prior to 5.6.12. It is, therefore, affected by multiple vulnerabilities : - A use-after-free error exists in file spldllist.c due to improper sanitization of input to the unserialize function. An attacker can...

PHPSHE SQL注入

简要描述： 又SQL注入了。 详细说明： WooYun: PHPSHE SQL注入 来看看这个去年的漏洞修复的怎么样了- - peselect'order', array'orderid'=$void; if $info'orderstate' == 'notpay' $order'orderoutid' = $vpmode; $order'orderpayway' = 'ebank'; $order'orderstate' = 'paid'; $order'orderptime' = time; $db-peupdate'order', array'orderid'=$void,...

PT-2014-8916

Name of the Vulnerable Software and Affected Versions MantisBT versions 1.1.0a3 through 1.2.17 Description A cross-site scripting XSS issue exists due to a problem in the projax array serialize for autocomplete function. This allows remote attackers to inject arbitrary web script or HTML via the...

PHP Core unserialize Function Integer Overflow (CVE-2014-3669)

A code execution vulnerability has been reported in PHP core. The vulnerability is due to an integer overflow within the unserialize function. A remote attacker can exploit the vulnerability by sending crafted serialize data to a web application running a vulnerable version of PHP. A successful...

PHPSHE SQL注入

简要描述： 默认配置验证绕过 详细说明： /include/plugin/payway/ebank/Receive.php中 ebankmd5 默认为空 ，可以生成sign绕过 include'../../../../common.php'; $cachepayway = cache::get'payway'; $payway = unserialize$cachepayway'ebank''paywayconfig'; $key = $payway'ebankmd5'; //默认为空 $void =trim$POST'void'; $vpmode =trim$POST'vpmode';...

CVE-2014-6072: CSRF vulnerability in the Web Profiler

Affected Versions All 2.0.X, 2.1.X, 2.2.X, 2.3.X, 2.4.X, and 2.5.X versions of the Symfony WebProfiler bundle are affected by this security issue. This issue has been fixed in Symfony 2.3.19, 2.4.9, and 2.5.4. Note that no fixes are provided for Symfony 2.0, 2.1, and 2.2 as they are not maintaine...

Fedora 20 : php-5.5.14-1.fc20 (2014-7765)

26 Jun 2014, PHP 5.5.14 Core : - Fixed BC break introduced by patch for bug 67072. Anatol, Stas - Fixed bug 66622 Closures do not correctly capture the late bound class static:: in some cases. Levi Morrison - Fixed bug 67390 insecure temporary file use in the configure script. CVE-2014-3981 Remi ...

PHPSHE B2C商城系统 sql注入

简要描述： sql注入，可获取数据库任意信息 详细说明： sql注入，可获取数据库任意信息 漏洞触发位置，已经触发函数 构造一个关联数组，键就是sql语句，用serialize序列化 将序列化之后的值作为cookie 漏洞证明： 访问以下...

Security fix for the ALT Linux 10 package glpi version 0.83.9.1-alt1

July 21, 2013 Pavel Zilke 0.83.9.1-alt1 - Security fixes: + CVE-2013-2225 + CVE-2013-2227 : Security fix serialize + filter classname for autoload ALT 29189...

CVE-2013-0277

ActiveRecord in Ruby on Rails before 2.3.17 and 3.x before 3.1.0 allows remote attackers to cause a denial of service or execute arbitrary code via crafted serialized attributes that cause the +serialize+ helper to deserialize arbitrary YAML...

PT-2013-2210

Name of the Vulnerable Software and Affected Versions Ruby on Rails versions prior to 2.3.17 Ruby on Rails versions 3.x prior to 3.1.0 Description The issue allows remote attackers to cause a denial of service or execute arbitrary code via crafted serialized attributes that cause the serialize...

CVE-2013-0277 rubygem-activerecord: Serialized Attributes YAML Vulnerability with Rails 2.3 and 3.0

ActiveRecord in Ruby on Rails before 2.3.17 and 3.x before 3.1.0 allows remote attackers to cause a denial of service or execute arbitrary code via crafted serialized attributes that cause the +serialize+ helper to deserialize arbitrary YAML...

Mozilla: Use-after-free in serializeToStream (MFSA 2013-16)

Use-after-free vulnerability in the serializeToStream implementation in the XMLSerializer component in Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.2, and SeaMonkey before...

PHP source code in the unserialize function throws a vulnerability analysis-vulnerability warning-the black bar safety net

0×0 1 unserialize function concept First look at the official given explanation: unserialize on single serialized variable operation, convert back to PHP values. The return is after the conversion the value can be integer, float, string, array or object. If the passed string cannot be serialized,...

SuSE 11.1 Security Update : Linux kernel (SAT Patch Number 5732)

The SUSE Linux Enterprise 11 SP1 kernel was updated to 2.6.32.54, fixing lots of bugs and security issues. The following security issues have been fixed : - A potential hypervisor escape by issuing SGIO commands to partitiondevices was fixed by restricting access to these commands. CVE-2011-4127 ...

[pdf] PHP serialize, session and dynamics

Презентация с семинара ВМиК МГУ secsem.ru 2010 года. http://onsec.ru/php-unserialize.pdf Информация актуальная...

Heap overflow

Heap-based buffer overflow in the CDrawPoly::Serialize function in fxscover.exe in Microsoft Windows Fax Services Cover Page Editor 5.2 r2 in Windows XP Professional SP3, Server 2003 R2 Enterprise Edition SP2, and Windows 7 Professional allows remote attackers to execute arbitrary code via a long...

Apple WebCore XMLHttpRequest fails to properly serialize headers into an HTTP request

Overview Apple WebCore fails to properly serialize headers into an HTTP request, which can cause a cross-domain security violation. Description Apple WebCore is one of the components of the WebKit web browser engine that is used by Safari, Dashboard, Mail, and other applications. WebCore provides...