PEAR 1.9.0 Remote File Inclusion

PEAR v.1.9.0 Multiple Remote File Inclusion Vulnerability PEAR, the PHP Extension and Application Repository @package PEAR @Version v.1.9.0 @license http://opensource.org/licenses/bsd-license.php New BSD License @link http://pear.php.net/package/PEAR Type : Remote File Inclusion Vulnerability...

PHP extension extension to bypass the upload filter-vulnerability warning-the black bar safety net

To everyone demo a php suffix extension; you can bypass the upload your own test. php extension suffix: php3 php4 php5 php. xxx asp extension suffix: asa asp comes into cdx cer idc pl plex plx shtm shtml stm php can be saved as xx. php. xxx automatically ignore the back of the. xxx may also perfo...

PHP "multipart/form-data" denial of service

No description provided by source. Description ------------ PHP version 5.3.1 was just released. This release contains a patch for a denial of service condition we've reported on 27 October 2009. The problem is related with PHP's handling of RFC 1867 Form-based File Upload in HTML. When you send ...

PHP "multipart/form-data" denial of service

Description ------------ PHP version 5.3.1 was just released. This release contains a patch for a denial of service condition we've reported on 27 October 2009. The problem is related with PHP's handling of RFC 1867 Form-based File Upload in HTML. When you send a POST request to a PHP script with...

PHP extension extension to bypass the upload filter-vulnerability warning-the black bar safety net

To everyone demo a php suffix extension; you can bypass the upload your own test. php extension suffix: php3 php4 php5 php. xxx asp extension suffix: asa asp comes into cdx cer idc pl plex plx shtm shtml stm php can be saved as xx. php. xxx automatically ignore the back of the. xxx may also perfo...

Icewarp Merak Mail Server 9.4.1 - Base64FileEncode() Buffer Overflow (PoC)

Icewarp Merak Mail Server 9.4.1 - Base64FileEncode Buffer Overflow PoC "cgi-fcgi" die"Launch from the merak php console!"; if !functionexists"icewarpapiobjectcall" die"You need the icewarp extension loaded!"; $shellcode= //original scode, alpha2 esp sh.txt...

Icewarp Merak Mail Server 9.4.1 - 'Base64FileEncode()' Buffer Overflow (PoC)

"cgi-fcgi" die"Launch from the merak php console!"; if !functionexists"icewarpapiobjectcall" die"You need the icewarp extension loaded!"; $shellcode= //original scode, alpha2 esp sh.txt "\xeb\x13\x5b\x31\xc0\x50\x31\xc0\x88\x43\x4a\x53". "\xbb\x0d\x25\x86\x7c". //WinExec, kernel32.dll XP SP3...

glFusion <= 1.1.2 COM_applyFilter()/order SQL Injection Exploit

Exploit for unknown platform in category web applications =============================================================== glFusion = 4.1 php.ini independent google dork: "Page created in" "seconds by glFusion" +RSS Vulnerability, sql injection in 'order' and 'direction' arguments: look...

PHPmotion 2.0 - update_profile.php Arbitrary File Upload

PHPmotion 2.0 - updateprofile.php Arbitrary File Upload = $limitsize 269. // Display file size error 270. // /////////////////////// 271. $show = 1; 272. $messagetype = $config"notificationsuccess";//the messsage displayed at t...

CMS from Scratch <= 1.1.3 (fckeditor) Remote Shell Upload Exploit

Exploit for unknown platform in category web applications ================================================================= CMS from Scratch = 1.1.3 fckeditor Remote Shell Upload Exploit ================================================================= ?php /...

Unrestricted file upload

Unrestricted file upload vulnerability in the ajoutcat mode in admin/main.php in Tr Script News 2.1 allows remote authenticated users to execute arbitrary code by uploading a file with a .php extension...

CVE-2007-4586

Multiple buffer overflows in phpiisfunc.dll in the iisfunc extension for PHP 5.2.0 and earlier allow context-dependent attackers to execute arbitrary code, probably during Unicode conversion, as demonstrated by a long string in the first argument to the iisgetservicestate function, related to the...

CVE-2007-4586

Multiple buffer overflows in phpiisfunc.dll in the iisfunc extension for PHP 5.2.0 and earlier allow context-dependent attackers to execute arbitrary code, probably during Unicode conversion, as demonstrated by a long string in the first argument to the iisgetservicestate function, related to the...

CVE-2007-3199

Unrestricted file upload vulnerability in Link Request Contact Form 3.4 allows remote attackers to execute arbitrary PHP code by uploading a file with a .php extension and an image content type, as demonstrated by image/jpeg...

CVE-2007-3199: Undefined Security Weakness

Unrestricted file upload vulnerability in Link Request Contact Form 3.4 allows remote attackers to execute arbitrary PHP code by uploading a file with a .php extension and an image content type, as demonstrated by image/jpeg...

CVE-2007-1709

Buffer overflow in the confirmphpdoccompiled function in the phpDOC extension PECL phpDOC in PHP 5.2.1 allows context-dependent attackers to execute arbitrary code via a long argument string...

CVE-2007-1552: Undefined Security Weakness

Unrestricted file upload vulnerability in usercp.php in MetaForum 0.513 Beta restricts file types based on the MIME type in the Content-type HTTP header, which allows remote attackers to upload and execute arbitrary scripts via an image MIME type with a filename containing an executable extension...

esser-php.txt

?php //////////////////////////////////////////////////////////////////////// // // // | || | | | | | | | || || \ // // | |/ || '|/ |/ -| ' \ / -/ |||| /| || / // // ||||,||| ,|||||||,| || |||||| // // // // Proof of concept code from the Hardened-PHP Project // // C Copyright 2007 Stefan...

BONUS-07-2007:Zend Platform ini_modifier Local Root Vulnerability

Summary Zend Platform comes with an inimodifier that is used by the GUI to alter the php.ini file. By abusing a vulnerability within the inimodifier it is possible for a local attacker to edit the php.ini file without knowing the necessary GUI password. This can be used to obtain root privileges ...

CS-Gallery 2.0 - index.php?album Remote File Inclusion

CS-Gallery 2.0 - index.php?album Remote File Inclusion ?php //File Inclusion Exploit for CSGallery = 2.0 //Found and Exploit Coded by burncycle - burncycleatrobert-berandotde //| //Vendor: http://www.cschneider.de/ //Dork: www.cschneider.info //| //Bug in "index.php": //...