php: $_FILES array indexes corruption

The file-upload implementation in rfc1867.c in PHP before 5.4.0 does not properly handle invalid open square bracket characters in name values, which makes it easier for remote attackers to cause a denial of service malformed $FILES indexes or conduct directory traversal attacks during multi-file...

PT-2012-1222 · Php +3 · Php +3

Name of the Vulnerable Software and Affected Versions: PHP versions prior to 5.3.14 PHP versions 5.4.x prior to 5.4.4 Description: The issue is related to errors in number processing in the PHP language interpreter extension. It may allow a remote attacker to execute arbitrary code or cause a...

PHP 5.3.x < 5.4.3 Multiple Vulnerabilities

Binary data 801071.prm...

SMF 2.0.1 - SQL Injection / Privilege Escalation

!/usr/bin/python -- coding: iso-8859-15 -- Exploit Title: Smf = 2.0.1 Sql injection Vulnerability Author: The:Paradox Disclosure date: 06/12/2011 Software Link: http://download.simplemachines.org/ , http://www.php.net/releases/ Smf = 2.0.1 Sql injection Vulnerability - Priviledge escalation explo...

php: hang on numeric value 2.2250738585072011e-308 with x87 fpu

strtod.c, as used in the zendstrtod function in PHP 5.2 before 5.2.17 and 5.3 before 5.3.5, and other products, allows context-dependent attackers to cause a denial of service infinite loop via a certain floating-point value in scientific notation, which is not properly handled in x87 FPU...

php: information leak vulnerability in var_export()

The varexport function in PHP 5.2 before 5.2.14 and 5.3 before 5.3.3 flushes the output buffer to the user when certain fatal errors occur, even if displayerrors is off, which allows remote attackers to obtain sensitive information by causing the application to exceed limits for memory, execution...

PHP < 5.2.14 / 5.3.x < 5.3.3 Multiple Vulnerabilities

Binary data 5616.prm...

WordPress Plugin Cimy Counter - Full Path Disclosure Redirector Cross-Site Scripting HTTP Response Spitting

WordPress Plugin Cimy Counter - Full Path Disclosure Redirector Cross-Site Scripting HTTP Response Spitting ---------------------------- Advisory: Vulnerabilities in Cimy Counter for WordPress ----------------------------- URL: http://sebug.net/exploit/19862/ ----------------------------- Affecte...

PT-2009-5607 · Php +1 · Php +1

Name of the Vulnerable Software and Affected Versions: PHP versions prior to 5.2.11 PHP versions 5.3.x prior to 5.3.1 Description: The issue allows context-dependent attackers to cause a denial of service crash via a crafted 1 "e" or 2 "er" string in the second argument aka mode of the popen API...

PHP Security Bypass and File Writing Vulnerabilities (Dec 2008)

PHP is prone to a security bypass and a file writing vulnerability. SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:php:php";...

PHP 'chdir()' and 'ftok()' 安全模式绕过漏洞

PHP' safemode‘设置的限制绕过漏洞。成功的攻击可能允许攻击者以确定存在的档案在未经批准的地点;其他攻击也是可能的。 开发这些问题可以让攻击者获得敏感的数据，可用于在其他的攻击。 这些弱点将是一个问题的共同主办的配置在多个用户可以创建并执行任意PHP脚本代码;在这种情况下， ' safemode设置'的限制， PHP的5.2.6是受影响的;其他版本也可能受到影响。 Slackware Linux 12.1 Slackware Linux 12.0 Slackware Linux -current PHP PHP 5.2.6 PHP PHP 5.2.5 PHP PHP 5.2.4...

Dedecms V5可执行文件上传漏洞

这是一个比较有意思的东西，但是成功利用起来并不容易，呵呵。 首先看configrglobals.php文件，摘的一段代码如下。这里作者本意是为了帮我们注册变量的，但是他却疏忽了我们不但能注册变量，还能覆盖一些变量。configrglobalsmagic.php也有同样的问题 ………………………………………………………………………… ifisarray$GET foreach$GET AS $key = $value $$key = $value; //可以覆盖任意变量 ………… …………………………………………………………………………...

php money_format format string issue

The moneyformat function in PHP 5 before 5.2.4, and PHP 4 before 4.4.8, permits multiple 1 %i and 2 %n tokens, which has unknown impact and attack vectors, possibly related to a format string vulnerability...

PT-2007-4176 · Php +1 · Php +1

Name of the Vulnerable Software and Affected Versions: PHP versions prior to 5.2.3 PHP versions prior to 4.4.8 Description: The issue is related to multiple integer overflows in the chunk split function. This can be exploited by remote attackers to cause a denial of service crash or execute...

security flaw

The mbparsestr function in PHP 4.0.0 through 4.4.6 and 5.0.0 through 5.2.1 sets the internal registerglobals flag and does not disable it in certain cases when a script terminates, which allows remote attackers to invoke available PHP scripts with registerglobals functionality that is not...

security flaw

Multiple integer overflows in the 1 createwbmp and 2 readwbmp functions in wbmp.c in the GD library libgd in PHP 4.0.0 through 4.4.6 and 5.0.0 through 5.2.1 allow context-dependent attackers to execute arbitrary code via Wireless Bitmap WBMP images with large width or height values...

security flaw

The Zend Engine in PHP 4.x before 4.4.7, and 5.x before 5.2.2, allows remote attackers to cause a denial of service stack exhaustion and PHP crash via deeply nested arrays, which trigger deep recursion in the variable destruction routines...

security flaw

The Zend Engine in PHP 4.x before 4.4.7, and 5.x before 5.2.2, allows remote attackers to cause a denial of service stack exhaustion and PHP crash via deeply nested arrays, which trigger deep recursion in the variable destruction routines...

security flaw

Multiple integer overflows in the 1 createwbmp and 2 readwbmp functions in wbmp.c in the GD library libgd in PHP 4.0.0 through 4.4.6 and 5.0.0 through 5.2.1 allow context-dependent attackers to execute arbitrary code via Wireless Bitmap WBMP images with large width or height values...

security flaw

Multiple integer overflows in the 1 createwbmp and 2 readwbmp functions in wbmp.c in the GD library libgd in PHP 4.0.0 through 4.4.6 and 5.0.0 through 5.2.1 allow context-dependent attackers to execute arbitrary code via Wireless Bitmap WBMP images with large width or height values...