exploit_cve-2021-29447

exploitcve-2021-29447 仅用于教育目的。 此漏洞利用工具旨在方便地从运行 WordPress 5.6.2 和 PHP8 的服务器上获取任何文件。（参见 https://wpscan.com/vulnerability/cbbe6c17-b24e-4be4-8937-c78472a138b5） 你只需要拥有基础的 wp-admin 访问权限以及上传媒体文件的能力。 该漏洞利用会生成一个 .wav 文件载荷，通过 wp-admin 上传。 然后它会利用漏洞利用的后端服务器，让你在控制台上即时获取文件。 完美适用场景：HackTheBox 的机器 - metatwo...

snuffleupagus

Snuffleupagus Security module for php7 and php8 - Killing bugclasses and virtual-patching the rest! Key Features • Download • Examples • Documentation • License • Thanks Snuffleupagus is a PHP 7+ and 8+ module designed to drastically raise the cost of attacks against websites, by killing entire b...

TimeAfterFree

TimeAfterFree PHP 8 サンドボックスエスケープ PoC。Unix系システムにおけるdisablefunctionsのバイパスを実証します。 このエクスプロイトは、use-after-freeバグを利用してdisablefunctionsをバイパスし、システムコマンドを実行します。ヒープポインタの漏洩や読み取り/書き込みプリミティブの取得に使用されるエクスプロイト技術は、DateIntervalオブジェクトを利用しています。...

Public_Exploit-1--Wordpress-CVE-2021-29447

PublicExploit-1--Wordpress-CVE-2021-29447 CVE-2021-29447 是 WordPress 中的一个经过身份验证的 XML 外部实体（XXE）漏洞 该漏洞存在于 WordPress 媒体库中，当 WordPress 运行在 PHP 8 上且用户具有上传媒体文件的权限时触发。一个特制的 .wav 文件可导致 WordPress 处理恶意 XML 并解析外部实体。 这可能导致： ● 任意文件泄露 — 读取目标服务器上的文件。 ● 服务端请求伪造（SSRF） — 从 WordPress 服务器发起请求。 ● 敏感信息泄露，例如...

CVE-2021-29447

CVE-2021-29447 POC para explotar la inyección XXE autenticada en WordPress 5.6-5.7 PHP 8+. Más información sobre este CVE aquí Ejemplo Ejemplo de uso contra la máquina MetaTwo de HackTheBox, que aloja un sitio web de WordPress con la biblioteca de medios vulnerable a la inyección XXE...

CVE-2021-29447-PoC

CVE-2021-29447 概念验证 root@kitploit: ╔═╗╦ ╦╔═╗ ║ ╚╗╔╝║╣────2021-29447 ╚═╝ ╚╝ ╚═╝ Written By Isa Ebrahim - 0xRar on January, 2023 ═══════════════════════════════════════════════════════════════════════════ 标题: Wordpress 媒体库中的 XML 解析问题导致 XXE 受影响版本: Wordpress 5.6 - 5.7 已修复版本: Wordpress 5.7.1 安装版本: PHP...

CVE-2021-29447

CVE-2021-29447 PoC このリポジトリには、WordPress 5.6 および 5.7 （PHP 8 使用時）に影響を与える CVE-2021-29447 脆弱性のための 概念実証（PoC） エクスプロイトが含まれています。このエクスプロイトは、アップロード権限を持つ攻撃者がメディアライブラリのXML解析の脆弱性を悪用し、XXE（XML External Entity）攻撃を引き起こし、結果としてターゲット環境からローカルファイルを外部に流出させる方法を示しています。 ⚠️ 免責事項 このプロジェクトは、教育、研究、および許可されたセキュリティテスト...

snuffleupagus

Snuffleupagus php7とphp8のためのセキュリティモジュール - バグクラスを排除し、残りを仮想パッチ!...

EUVD-2023-51635

Malicious code in bioql PyPI...

CVE-2024-4577 Argument Injection in PHP-CGI

In PHP versions 8.1. before 8.1.29, 8.2. before 8.2.20, 8.3. before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may...

SUSE SLES15: apache2-mod_php8 / php8 / php8-bcmath / php8-bz2 / php8-calendar / etc (SUSE-SU-2024:1446-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:1446-1 advisory. - CVE-2024-2756: Fixed bypass of security fix applied for CVE-2022-31629 that lead PHP to consider not secure cookies...

CVE-2024-28859

Symfony1 is a community fork of symfony 1.4 with DIC, form enhancements, latest Swiftmailer, better performance, composer compatible and PHP 8 support. Symfony 1 has a gadget chain due to vulnerable Swift Mailer dependency that would enable an attacker to get remote code execution if a developer...

CVE-2024-28859 Gadget chain in Symfony 1 due to vulnerable Swift Mailer dependency

Symfony1 is a community fork of symfony 1.4 with DIC, form enhancements, latest Swiftmailer, better performance, composer compatible and PHP 8 support. Symfony 1 has a gadget chain due to vulnerable Swift Mailer dependency that would enable an attacker to get remote code execution if a developer...

CVE-2024-28859 Gadget chain in Symfony 1 due to vulnerable Swift Mailer dependency

Symfony1 is a community fork of symfony 1.4 with DIC, form enhancements, latest Swiftmailer, better performance, composer compatible and PHP 8 support. Symfony 1 has a gadget chain due to vulnerable Swift Mailer dependency that would enable an attacker to get remote code execution if a developer...

BIT-WORDPRESS-2021-29447 WordPress Authenticated XXE attack when installation is running PHP 8

Wordpress is an open source CMS. A user with the ability to upload files like an Author can exploit an XML parsing issue in the Media Library leading to XXE attacks. This requires WordPress installation to be using PHP 8. Access to internal files is possible in a successful XXE attack. This has...

BIT-WORDPRESS-MULTISITE-2021-29447 WordPress Authenticated XXE attack when installation is running PHP 8

Wordpress is an open source CMS. A user with the ability to upload files like an Author can exploit an XML parsing issue in the Media Library leading to XXE attacks. This requires WordPress installation to be using PHP 8. Access to internal files is possible in a successful XXE attack. This has...

External Control Of Filename

phenx/php-svg-lib is vulnerable to External Control of Filename. The vulnerability is due to insecure handling of inline CSS font definitions, allowing an attacker to deserialize a PHAR file through the phar:// URL handler. Note that remote code execution is only possible on PHP versions less the...

Insecure Deserialization/Unsafe Attributes Merge

phenx/php-svg-lib is vulnerable to Insecure Deserialization. The vulnerability is caused due to unsafe attributes such as href, xlink:href and id while merging attributes from the tag to the tag when handling a tag that references an tag. This can lead to an unsafe file read that can cause PHAR...

CVE-2023-50252

php-svg-lib is an SVG file parsing / rendering library. Prior to version 0.5.1, when handling tag that references an tag, it merges the attributes from the tag to the tag. The problem pops up especially when the href attribute from the tag has not been sanitized. This can lead to an unsafe file...

CVE-2023-50252 php-svg-lib unsafe attributes merge when parsing `use` tag

php-svg-lib is an SVG file parsing / rendering library. Prior to version 0.5.1, when handling tag that references an tag, it merges the attributes from the tag to the tag. The problem pops up especially when the href attribute from the tag has not been sanitized. This can lead to an unsafe file...