snuffleupagus

Snuffleupagus Security module for php7 and php8 - Killing bugclasses and virtual-patching the rest! Key Features • Download • Examples • Documentation • License • Thanks Snuffleupagus is a PHP 7+ and 8+ module designed to drastically raise the cost of attacks against websites, by killing entire b...

TimeAfterFree

TimeAfterFree PHP 8 sandbox escape PoC demonstrating a disablefunctions bypass on Unix-like systems. This exploit leverages a use-after-free bug to bypass disablefunctions and execute system commands. The exploitation techniques used for leaking heap pointers and obtaining read/write primitives...

Public_Exploit-1--Wordpress-CVE-2021-29447

PublicExploit-1--Wordpress-CVE-2021-29447 CVE-2021-29447 是 WordPress 中的一个经过身份验证的 XML 外部实体（XXE）漏洞 该漏洞存在于 WordPress 媒体库中，当 WordPress 运行在 PHP 8 上且用户具有上传媒体文件的权限时触发。一个特制的 .wav 文件可导致 WordPress 处理恶意 XML 并解析外部实体。 这可能导致： ● 任意文件泄露 — 读取目标服务器上的文件。 ● 服务端请求伪造（SSRF） — 从 WordPress 服务器发起请求。 ● 敏感信息泄露，例如...

CVE-2021-29447

CVE-2021-29447 POC para explotar la inyección XXE autenticada en WordPress 5.6-5.7 PHP 8+. Más información sobre este CVE aquí Ejemplo Ejemplo de uso contra la máquina MetaTwo de HackTheBox, que aloja un sitio web de WordPress con la biblioteca de medios vulnerable a la inyección XXE...

exploit_cve-2021-29447

exploitcve-2021-29447 仅用于教育目的。 此漏洞利用工具旨在方便地从运行 WordPress 5.6.2 和 PHP8 的服务器上获取任何文件。（参见 https://wpscan.com/vulnerability/cbbe6c17-b24e-4be4-8937-c78472a138b5） 你只需要拥有基础的 wp-admin 访问权限以及上传媒体文件的能力。 该漏洞利用会生成一个 .wav 文件载荷，通过 wp-admin 上传。 然后它会利用漏洞利用的后端服务器，让你在控制台上即时获取文件。 完美适用场景：HackTheBox 的机器 - metatwo...

CVE-2021-29447-PoC

CVE-2021-29447 Proof-of-Concept root@kitploit: ╔═╗╦ ╦╔═╗ ║ ╚╗╔╝║╣────2021-29447 ╚═╝ ╚╝ ╚═╝ Written By Isa Ebrahim - 0xRar on January, 2023 ═══════════════════════════════════════════════════════════════════════════ Title: Wordpress XML parsing issue in the Media Library leading to XXE Affected...

CVE-2021-29447

CVE-2021-29447 PoC 本仓库包含针对 CVE-2021-29447 漏洞的概念验证（PoC）漏洞利用工具，该漏洞影响使用 PHP 8 的 WordPress 5.6 和 5.7 。该工具演示了攻击者如何在具备文件上传能力的情况下，利用媒体库中的 XML 解析漏洞，导致 XXE（XML 外部实体）攻击，并进而从目标环境中窃取本地文件。 ⚠️ 免责声明 本项目仅用于教育、研究和授权安全测试目的 。 请勿在您不拥有或未经明确许可的系统上使用此代码。 作者对任何损害或滥用不承担任何责任 。 使用方法 root@kitploit:...

snuffleupagus

Snuffleupagus Security module for php7 and php8 - Killing bugclasses and virtual-patching the rest!...

EUVD-2023-51635

Malicious code in bioql PyPI...

CVE-2024-4577 Argument Injection in PHP-CGI

In PHP versions 8.1. before 8.1.29, 8.2. before 8.2.20, 8.3. before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may...

SUSE SLES15: apache2-mod_php8 / php8 / php8-bcmath / php8-bz2 / php8-calendar / etc (SUSE-SU-2024:1446-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:1446-1 advisory. - CVE-2024-2756: Fixed bypass of security fix applied for CVE-2022-31629 that lead PHP to consider not secure cookies...

CVE-2024-28859

Symfony1 is a community fork of symfony 1.4 with DIC, form enhancements, latest Swiftmailer, better performance, composer compatible and PHP 8 support. Symfony 1 has a gadget chain due to vulnerable Swift Mailer dependency that would enable an attacker to get remote code execution if a developer...

CVE-2024-28859 Gadget chain in Symfony 1 due to vulnerable Swift Mailer dependency

Symfony1 is a community fork of symfony 1.4 with DIC, form enhancements, latest Swiftmailer, better performance, composer compatible and PHP 8 support. Symfony 1 has a gadget chain due to vulnerable Swift Mailer dependency that would enable an attacker to get remote code execution if a developer...

CVE-2024-28859 Gadget chain in Symfony 1 due to vulnerable Swift Mailer dependency

Symfony1 is a community fork of symfony 1.4 with DIC, form enhancements, latest Swiftmailer, better performance, composer compatible and PHP 8 support. Symfony 1 has a gadget chain due to vulnerable Swift Mailer dependency that would enable an attacker to get remote code execution if a developer...

BIT-WORDPRESS-2021-29447 WordPress Authenticated XXE attack when installation is running PHP 8

Wordpress is an open source CMS. A user with the ability to upload files like an Author can exploit an XML parsing issue in the Media Library leading to XXE attacks. This requires WordPress installation to be using PHP 8. Access to internal files is possible in a successful XXE attack. This has...

BIT-WORDPRESS-MULTISITE-2021-29447 WordPress Authenticated XXE attack when installation is running PHP 8

Wordpress is an open source CMS. A user with the ability to upload files like an Author can exploit an XML parsing issue in the Media Library leading to XXE attacks. This requires WordPress installation to be using PHP 8. Access to internal files is possible in a successful XXE attack. This has...

External Control Of Filename

phenx/php-svg-lib is vulnerable to External Control of Filename. The vulnerability is due to insecure handling of inline CSS font definitions, allowing an attacker to deserialize a PHAR file through the phar:// URL handler. Note that remote code execution is only possible on PHP versions less the...

Insecure Deserialization/Unsafe Attributes Merge

phenx/php-svg-lib is vulnerable to Insecure Deserialization. The vulnerability is caused due to unsafe attributes such as href, xlink:href and id while merging attributes from the tag to the tag when handling a tag that references an tag. This can lead to an unsafe file read that can cause PHAR...

CVE-2023-50252

php-svg-lib is an SVG file parsing / rendering library. Prior to version 0.5.1, when handling tag that references an tag, it merges the attributes from the tag to the tag. The problem pops up especially when the href attribute from the tag has not been sanitized. This can lead to an unsafe file...

CVE-2023-50252 php-svg-lib unsafe attributes merge when parsing `use` tag

php-svg-lib is an SVG file parsing / rendering library. Prior to version 0.5.1, when handling tag that references an tag, it merges the attributes from the tag to the tag. The problem pops up especially when the href attribute from the tag has not been sanitized. This can lead to an unsafe file...