exploit_cve-2021-29447

exploitcve-2021-29447 Solo para fines educativos. Se supone que este exploit es una herramienta muy conveniente para obtener cualquier archivo de un servidor que ejecute wordpress 5.6.2 y php8. ver https://wpscan.com/vulnerability/cbbe6c17-b24e-4be4-8937-c78472a138b5 Todo lo que necesitas es acce...

snuffleupagus

Snuffleupagus Security module for php7 and php8 - Killing bugclasses and virtual-patching the rest! Key Features • Download • Examples • Documentation • License • Thanks Snuffleupagus is a PHP 7+ and 8+ module designed to drastically raise the cost of attacks against websites, by killing entire b...

TimeAfterFree

TimeAfterFree PHP 8 沙盒逃逸 PoC，演示在类Unix系统上绕过 disablefunctions。 该利用利用一个释放后使用（use-after-free）漏洞来绕过 disablefunctions 并执行系统命令。用于泄露堆指针和获取读写原语的利用技术使用了 DateInterval 对象。 该 PoC 已在多种标准 PHP 发行版和常见服务器 API（CLI、PHP-FPM、Apache 模块）上测试，并可确定性地重现。 受影响版本 PHP 8.2.x PHP 8.3.x PHP 8.4.x PHP 8.5.x 缓解措施 / 说明 PHP 核心内存不安全，典型...

Public_Exploit-1--Wordpress-CVE-2021-29447

PublicExploit-1--Wordpress-CVE-2021-29447 CVE-2021-29447 es una vulnerabilidad de entidad externa XML XXE autenticada en WordPress La vulnerabilidad existe en la Biblioteca de Medios de WordPress cuando WordPress se ejecuta en PHP 8 y el usuario tiene permiso para subir archivos multimedia. Un...

CVE-2021-29447

CVE-2021-29447 POC para explotar la inyección XXE autenticada en WordPress 5.6-5.7 PHP 8+. Más información sobre este CVE aquí Ejemplo Ejemplo de uso contra la máquina MetaTwo de HackTheBox, que aloja un sitio web de WordPress con la biblioteca de medios vulnerable a la inyección XXE...

CVE-2021-29447-PoC

CVE-2021-29447 概念验证 root@kitploit: ╔═╗╦ ╦╔═╗ ║ ╚╗╔╝║╣────2021-29447 ╚═╝ ╚╝ ╚═╝ Written By Isa Ebrahim - 0xRar on January, 2023 ═══════════════════════════════════════════════════════════════════════════ 标题: Wordpress 媒体库中的 XML 解析问题导致 XXE 受影响版本: Wordpress 5.6 - 5.7 已修复版本: Wordpress 5.7.1 安装版本: PHP...

CVE-2021-29447

CVE-2021-29447 PoC Este repositorio contiene un exploit de Prueba de Concepto PoC para la vulnerabilidad CVE-2021-29447 que afecta a WordPress 5.6 y 5.7 usando PHP 8. El exploit demuestra cómo un atacante, con la capacidad de subir archivos, puede explotar una vulnerabilidad de análisis XML en la...

snuffleupagus

Snuffleupagus 适用于 php7 和 php8 的安全模块 - 消除 bug 类别并对其余进行虚拟补丁！ 主要特性 • 下载 • 示例 • 文档 • 许可证 • 致谢 Snuffleupagus 是一个 PHP 7+ 和 8+ 模块，旨在通过消除整个 bug 类别来大幅提高攻击网站的成本。它同时还提供了一个强大的虚拟补丁系统，使管理员无需修改 PHP 代码即可修复特定漏洞并审计可疑行为。 主要特性 无明显的性能影响 强大但易于编写的虚拟补丁规则 消除几类漏洞 基于反序列化的代码执行 基于 mail 的代码执行 窃取 Cookie 的 XSS 基于文件上传的代码执行 弱 PRN...

EUVD-2023-51635

Malicious code in bioql PyPI...

CVE-2024-4577 Argument Injection in PHP-CGI

In PHP versions 8.1. before 8.1.29, 8.2. before 8.2.20, 8.3. before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may...

SUSE SLES15: apache2-mod_php8 / php8 / php8-bcmath / php8-bz2 / php8-calendar / etc (SUSE-SU-2024:1446-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:1446-1 advisory. - CVE-2024-2756: Fixed bypass of security fix applied for CVE-2022-31629 that lead PHP to consider not secure cookies...

CVE-2024-28859

Symfony1 is a community fork of symfony 1.4 with DIC, form enhancements, latest Swiftmailer, better performance, composer compatible and PHP 8 support. Symfony 1 has a gadget chain due to vulnerable Swift Mailer dependency that would enable an attacker to get remote code execution if a developer...

CVE-2024-28859 Gadget chain in Symfony 1 due to vulnerable Swift Mailer dependency

Symfony1 is a community fork of symfony 1.4 with DIC, form enhancements, latest Swiftmailer, better performance, composer compatible and PHP 8 support. Symfony 1 has a gadget chain due to vulnerable Swift Mailer dependency that would enable an attacker to get remote code execution if a developer...

CVE-2024-28859 Gadget chain in Symfony 1 due to vulnerable Swift Mailer dependency

Symfony1 is a community fork of symfony 1.4 with DIC, form enhancements, latest Swiftmailer, better performance, composer compatible and PHP 8 support. Symfony 1 has a gadget chain due to vulnerable Swift Mailer dependency that would enable an attacker to get remote code execution if a developer...

BIT-WORDPRESS-2021-29447 WordPress Authenticated XXE attack when installation is running PHP 8

Wordpress is an open source CMS. A user with the ability to upload files like an Author can exploit an XML parsing issue in the Media Library leading to XXE attacks. This requires WordPress installation to be using PHP 8. Access to internal files is possible in a successful XXE attack. This has...

BIT-WORDPRESS-MULTISITE-2021-29447 WordPress Authenticated XXE attack when installation is running PHP 8

Wordpress is an open source CMS. A user with the ability to upload files like an Author can exploit an XML parsing issue in the Media Library leading to XXE attacks. This requires WordPress installation to be using PHP 8. Access to internal files is possible in a successful XXE attack. This has...

External Control Of Filename

phenx/php-svg-lib is vulnerable to External Control of Filename. The vulnerability is due to insecure handling of inline CSS font definitions, allowing an attacker to deserialize a PHAR file through the phar:// URL handler. Note that remote code execution is only possible on PHP versions less the...

Insecure Deserialization/Unsafe Attributes Merge

phenx/php-svg-lib is vulnerable to Insecure Deserialization. The vulnerability is caused due to unsafe attributes such as href, xlink:href and id while merging attributes from the tag to the tag when handling a tag that references an tag. This can lead to an unsafe file read that can cause PHAR...

CVE-2023-50252

php-svg-lib is an SVG file parsing / rendering library. Prior to version 0.5.1, when handling tag that references an tag, it merges the attributes from the tag to the tag. The problem pops up especially when the href attribute from the tag has not been sanitized. This can lead to an unsafe file...

CVE-2023-50252 php-svg-lib unsafe attributes merge when parsing `use` tag

php-svg-lib is an SVG file parsing / rendering library. Prior to version 0.5.1, when handling tag that references an tag, it merges the attributes from the tag to the tag. The problem pops up especially when the href attribute from the tag has not been sanitized. This can lead to an unsafe file...