Ext 1.0 (feed-proxy.php feed) Remote File Disclosure Vulnerability

Exploit for unknown platform in category web applications ================================================================== Ext 1.0 feed-proxy.php feed Remote File Disclosure Vulnerability ================================================================== ext 1.0 alpha1 feed-proxy.php Remote Fil...

CVE-2007-1900: Undefined Security Weakness

CRLF injection vulnerability in the FILTERVALIDATEEMAIL filter in ext/filter in PHP 5.2.0 and 5.2.1 allows context-dependent attackers to inject arbitrary e-mail headers via an e-mail address with a '\n' character, which causes a regular expression to ignore the subsequent part of the address...

PHP ext/gd use after free() vulnerability

During exceptional conditions handling, some resourceses aree freeed and later accessed...

CVE-2007-1582: Undefined Security Weakness

The resource system in PHP 4.0.0 through 4.4.6 and 5.0.0 through 5.2.1 allows context-dependent attackers to execute arbitrary code by interrupting certain functions in the GD ext/gd extension and unspecified other extensions via a userspace error handler, which can be used to destroy and modify...

PHP <= 4.4.6 / 5.2.1 ext/gd Already Freed Resources Usage Exploit

No description provided by source. ?php //////////////////////////////////////////////////////////////////////// // // // | || | | | | | | \| || || \ // // | |/ || '|/ |/ -| ' \ / -/ |||| /| || / //...

PHP <= 4.4.6 / 5.2.1 ext/gd Already Freed Resources Usage Exploit

No description provided by source. ?php //////////////////////////////////////////////////////////////////////// // // // | || | | | | | | | || || \ // // | |/ || '|/ |/ -| ' \ / -/ |||| /| || / // // ||||,||| ,|||||||,| || |||||| // // // // Proof of concept code from the Hardened-PHP...

PHP 4.4.6/5.2.1 - ext/gd Already Freed Resources Usage

?php //////////////////////////////////////////////////////////////////////// // // // | || | | | | | | | || || \ // // | |/ || '|/ |/ -| ' \ / -/ |||| /| || / // // ||||,||| ,|||||||,| || |||||| // // // // Proof of concept code from the Hardened-PHP Project // // C Copyright 2007 Stefan...

CVE-2007-1452: Undefined Security Weakness

The FDF support ext/fdf in PHP 5.2.0 and earlier does not implement the input filtering hooks for ext/filter, which allows remote attackers to bypass web site filters via an application/vnd.fdf formatted POST...

PHP 5.2.0 ext/filter Space Trimming Buffer Underflow Exploit (MacOSX)

No description provided by source. ?php //////////////////////////////////////////////////////////////////////// // // // | || | | | | | | | || || \ // // | |/ || '|/ |/ -| ' \ / -/ |||| /| || / //...

CVE-2007-1453: Undefined Security Weakness

Buffer underflow in the PHPFILTERTRIMDEFAULT macro in the filtering extension ext/filter in PHP 5.2.0 allows context-dependent attackers to execute arbitrary code by calling filtervar with certain modes such as FILTERVALIDATEINT, which causes filter to write a null byte in whitespace that precede...

CVE-2007-1454: Undefined Security Weakness

ext/filter in PHP 5.2.0, when FILTERSANITIZESTRING is used with the FILTERFLAGSTRIPLOW flag, does not properly strip HTML tags, which allows remote attackers to conduct cross-site scripting XSS attacks via HTML with a '' character followed by certain whitespace characters, which passes one filter...

PHP ext/filter FDF Post数据过滤绕过漏洞

PHP是广泛使用的通用目的脚本语言，特别适合于Web开发，可嵌入到HTML中。 PHP新实现的ext/filter FDF扩展实现上存在漏洞，远程攻击者可能利用此绕过用户数据过滤，从而在服务器上执行各种注入攻击。 根据设计，PHP的内容过滤钩子会在所有解析用户输入并注册为变量的地方添加对输入过滤器的调用，以确定如何处理这些变量，但添加对其他POST内容类型支持的所有扩展也需要实现钩子，否则数据就会绕过过滤。如果安装了ext/fdf的话PHP就会捆绑一个对FDF POST数据格式的扩展，但没有调用输入过滤器，因此攻击者就可能绕过所强制的过滤机制，获得非授权访问。 PHP = 5.2.0...

PHP 5.2.0 ext/filter Space Trimming Buffer Underflow Exploit (MacOSX)

Exploit for macOS platform in category local exploits ===================================================================== PHP 5.2.0 ext/filter Space Trimming Buffer Underflow Exploit MacOSX ===================================================================== ?php...

PHP 5.2.0 (OSX) - EXT/Filter Space Trimming Buffer Underflow

?php //////////////////////////////////////////////////////////////////////// // // // | || | | | | | | | || || \ // // | |/ || '|/ |/ -| ' \ / -/ |||| /| || / // // ||||,||| ,|||||||,| || |||||| // // // // Proof of concept code from the Hardened-PHP Project // // C Copyright 2007 Stefan...

PHP < 4.4.5 / 5.2.1 (shmop) SSL RSA Private-Key Disclosure Exploit

No description provided by source. ?php //////////////////////////////////////////////////////////////////////// // // // | || | | | | | | | || || \ // // | |/ || '|/ |/ -| ' \ / -/ |||| /| || / // // ||||,||| ,|||||||,| || |||||| // // // // Proof of concept code from the Hardened-PHP...

PHP Session.Save_Path() Safe_Mode和Open_Basedir限制绕过漏洞

PHP是一款流行的网络编程语言。 PHP在处理会话信息的功能函数实现上存在漏洞，远程攻击者可能利用漏洞获得敏感信息或向非授权位置写入文件。 session.savepath可以设置在iniset, sessionsavepath函数中，在session.savepath必须包含保存tmp文件路径的数据，但session.savepath的语法为： /PATH 或者 N;/PATH N是字符串。 如： 1. sessionsavepath"/DIR/WHERE/YOU/HAVE/ACCESS" 2. sessionsavepath"5;/DIR/WHERE/YOU/HAVE/ACCESS"...

CVE-2006-4482

Multiple heap-based buffer overflows in the 1 strrepeat and 2 wordwrap functions in ext/standard/string.c in PHP before 5.1.5, when used on a 64-bit system, have unspecified impact and attack vectors, a different vulnerability than CVE-2006-1990...

CVE-2006-4482: Out-of-bounds Write

Multiple heap-based buffer overflows in the 1 strrepeat and 2 wordwrap functions in ext/standard/string.c in PHP before 5.1.5, when used on a 64-bit system, have unspecified impact and attack vectors, a different vulnerability than CVE-2006-1990...

SAPID CMS remote File Inclusion vulnerabilities

Title: SAPID CMS remote File Inclusion Vulnerabilities Author: Simo64 simo64atmorxorg Discovered: 06 Aout 2006 MorX Security Research Team http://www.morx.org Vendor : SAPID CMS Version : 123 rc3 Website : http://sapid.sourceforge.net Severity: Critical Details: + Remote File Inclusion 1 vulnerab...

CVE-2006-1668

newimage.php in Eric Gerdes Crafty Syntax Image Gallery CSIG aka PHP thumbnail Photo Gallery 3.1g and earlier allows remote authenticated users to upload and execute arbitrary PHP code via a multipart/form-data POST with a .jpg filename in the fullimage parameter and the ext parameter set to .php...