PT-2020-5321 · Php +7 · Php +7

Name of the Vulnerable Software and Affected Versions: PHP versions 7.2.x through 7.2.27 PHP versions 7.3.x through 7.3.14 PHP versions 7.4.x through 7.4.2 Description: The issue is related to the incorrect preservation of permissions when creating PHAR archives using the...

CVE-2020-8801

SuiteCRM through 7.11.11 allows PHAR Deserialization...

CVE-2020-8801

SuiteCRM through 7.11.11 allows PHAR Deserialization...

CVE-2020-8801

SuiteCRM through 7.11.11 allows PHAR Deserialization...

Deserialization of untrusted data

SuiteCRM through 7.11.11 allows PHAR Deserialization...

CVE-2020-8801

CVE-2020-8801 affects SuiteCRM up to version 7.11.11. It enables Phar Deserialization via phar:// streams, allowing PHP object injection and potential code execution. Some vectors require elevated rights (e.g., admin). Remediation: upgrade to SuiteCRM 7.11.12 or later.

CVE-2020-8801

SuiteCRM through 7.11.11 allows PHAR Deserialization...

Multiple Phar Deserialization Vulnerabilities in SuiteCRM

SuiteCRM is a free and open source customer relationship management application. SuiteCRM suffers from multiple Phar deserialization vulnerabilities. An attacker can exploit the vulnerabilities to inject arbitrary PHP objects into the scope of the application, allowing the execution of various...

Huawei EulerOS: Security Advisory for php (EulerOS-SA-2019-2649)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2018-20783

In PHP before 5.6.39, 7.x before 7.0.33, 7.1.x before 7.1.25, and 7.2.x before 7.2.13, a buffer over-read in PHAR reading functions may allow an attacker to read allocated or unallocated memory past the actual data when trying to parse a .phar file. This is related to pharparsepharfile in...

Gila CMS File Unrestricted Upload Vulnerability

Gila CMS is an open source content management system CMS based on PHP and MySQL. Gila CMS 1.11.8 suffers from a file unrestricted upload vulnerability. An attacker can upload dangerous types of files to lzld/thumb?src= URI via .phar or .phtml, which can enable remote code execution...

LKWA - Lesser Known Web Attack Lab

Lesser Known Web Attack Lab is for intermediate pentester that can test and practice lesser known web attacks such as Object Injection, XSSI, PHAR Deserialization, variables variable ..etc. Write-ups are welcome. Installation Just clone the git with git clone https://github.com/weev3/LKWA and mov...

CVE-2020-5514

Gila CMS 1.11.8 allows Unrestricted Upload of a File with a Dangerous Type via .phar or .phtml to the lzld/thumb?src= URI...

CVE-2020-5514

Gila CMS 1.11.8 allows Unrestricted Upload of a File with a Dangerous Type via .phar or .phtml to the lzld/thumb?src= URI...

Unrestricted file upload

Gila CMS 1.11.8 allows Unrestricted Upload of a File with a Dangerous Type via .phar or .phtml to the lzld/thumb?src= URI...

CVE-2019-9675

An issue was discovered in PHP 7.x before 7.1.27 and 7.3.x before 7.3.3. phartarwriteheadersint in ext/phar/tar.c has a buffer overflow via a long link value. NOTE: The vendor indicates that the link value is used only when an archive contains a symlink, which currently cannot happen: "This issue...

The vulnerability of the Phar utility in the Drupal CMS system allows a hacker to execute arbitrary code.

The vulnerability of the phar utility in the Drupal CMS system is related to insufficient validation of entered data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using a specially created file with the .phar extension...

The vulnerability in the ext/phar/phar_object.c component of the PHP interpreter allows attackers to execute cross-site scripting (XSS) attacks.

The vulnerability in the ext/phar/pharobject.c component of the PHP interpreter exists due to the lack of measures taken to protect web page structures. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting XSS attacks remotely...

CVE-2019-8141

A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3. An authenticated user with administrative privileges system level import can execute arbitrary code through a Phar deserialization vulnerability in the import...

CVE-2019-8141

A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3. An authenticated user with administrative privileges system level import can execute arbitrary code through a Phar deserialization vulnerability in the import...