29 matches found
phpggc
PHPGGC: Cadenas de Gadgets Genéricas de PHP PHPGGC es una librería de payloads de unserialize junto con una herramienta para generarlos, desde la línea de comandos o programáticamente. Cuando te encuentras con un unserialize en un sitio web del que no tienes el código, o simplemente cuando intent...
Laravel-8.4.2-rce-CVE-2021-3129
Laravel-8.4.2-rce-CVE-2021-3129 exploit.py tested use python3,and only working with phpggc . first docker-compose up port on 8888 at 127.0.0.1 generate key first...
wordpress-php-object-helper
wordpress-php-object-helper Acerca de ¿Tienes un plugin conocido con un exploit de objetos PHP?, pero necesitas determinar qué librería usar para explotar el problema y ejecutarlo con phpggc. Esto debería ayudarte. Ejemplo de salida $ python3 finder.py -u http://wordpress.lan -f wp-plugins.lst...
CVE-2021-3129
CVE-2021-3129 Laravel Ignition 未授权远程代码执行（通过文件上传） CVE 概述 在受影响的 Laravel Ignition 版本中，攻击者可以利用 filegetcontents 和 fileputcontents 的不安全使用来执行任意代码。此漏洞仅对使用调试模式的网站可被利用。 受影响版本 Laravel Ignition 2.5.2 和 Laravel 8.4.2 注意事项 该漏洞需要 PHP 利用链，因此使用 phpggc。可以通过以下方式实现： 如果尚未克隆：git clone...
CVE-2018-15133-PoC
CVE-2018-15133-PoC 此 Python 脚本利用 CVE-2018-15133 漏洞，针对存在不安全反序列化漏洞的 Laravel 应用实现远程代码执行（RCE）。 该漏洞利用 Laravel（5.5.40 及更早版本，以及 5.6.0 至 5.6.29）中已加密的会话会自动反序列化且缺乏适当验证的弱点。在获取 Laravel 的 APPKEY 后，攻击者可加密恶意负载，这些负载将被反序列化并在服务器上执行。 Laravel 会话系统工作原理 Laravel 使用对称加密机制处理会话，包含三个组件： IV（初始化向量）：每次会话随机生成的初始化向量 Value：使用...
CVE-2024-40624
TorrentPier is an open source BitTorrent Public/Private tracker engine, written in php. In torrentpier/library/includes/functions.php, gettracks uses the unsafe native PHP serialization format to deserialize user-controlled cookies. One can use phpggc and the chain Guzzle/FW1 to write PHP code to...
CVE-2024-40624 Deserialization of untrusted data in torrentpier/torrentpier
TorrentPier is an open source BitTorrent Public/Private tracker engine, written in php. In torrentpier/library/includes/functions.php, gettracks uses the unsafe native PHP serialization format to deserialize user-controlled cookies. One can use phpggc and the chain Guzzle/FW1 to write PHP code to...
CVE-2024-40624 Deserialization of untrusted data in torrentpier/torrentpier
TorrentPier is an open source BitTorrent Public/Private tracker engine, written in php. In torrentpier/library/includes/functions.php, gettracks uses the unsafe native PHP serialization format to deserialize user-controlled cookies. One can use phpggc and the chain Guzzle/FW1 to write PHP code to...
CVE-2024-40624 Deserialization of untrusted data in torrentpier/torrentpier
TorrentPier is an open source BitTorrent Public/Private tracker engine, written in php. In torrentpier/library/includes/functions.php, gettracks uses the unsafe native PHP serialization format to deserialize user-controlled cookies. One can use phpggc and the chain Guzzle/FW1 to write PHP code to...
TorrentPier Deserialization of Untrusted Data vulnerability
Summary In torrentpier/library/includes/functions.php, gettracks uses the unsafe native PHP serialization format to deserialize user-controlled cookies: https://github.com/torrentpier/torrentpier/blob/84f6c9f4a081d9ffff4c233098758280304bf50f/library/includes/functions.phpL41-L60 PoC One can use...
GHSA-FG86-4C2R-7WXW TorrentPier Deserialization of Untrusted Data vulnerability
Summary In torrentpier/library/includes/functions.php, gettracks uses the unsafe native PHP serialization format to deserialize user-controlled cookies: https://github.com/torrentpier/torrentpier/blob/84f6c9f4a081d9ffff4c233098758280304bf50f/library/includes/functions.phpL41-L60 PoC One can use...
CVE-2024-40624: Deserialization of Untrusted Data
TorrentPier is an open source BitTorrent Public/Private tracker engine, written in php. In torrentpier/library/includes/functions.php, gettracks uses the unsafe native PHP serialization format to deserialize user-controlled cookies. One can use phpggc and the chain Guzzle/FW1 to write PHP code to...
GHSA-PV9J-C53Q-H433 Gadget chain in Symfony 1 due to uncontrolled unserialized input in sfNamespacedParameterHolder
Summary Symfony 1 has a gadget chain due to dangerous unserialize in sfNamespacedParameterHolder class that would enable an attacker to get remote code execution if a developer unserialize user input in his project. Details This vulnerability present no direct threat but is a vector that will...
Deserialization Gadget chain in Symfony sfNamespacedParameterHolder
Summary Symfony 1 has a gadget chain due to dangerous unserialize in sfNamespacedParameterHolder class that would enable an attacker to get remote code execution if a developer unserialize user input in his project. Details This vulnerability present no direct threat but is a vector that will...
Slider Revolution < 6.6.19 - Author+ Insecure Deserialization leading to RCE
Description The plugin does not prevent users with at least the Author role from unserializing arbitrary content when importing sliders, potentially leading to Remote Code Execution. 1. Make sure to configure the plugin so Authors can access its settings 2. Create a new slider. 3. Save and export...
WordPress Releases Update 6.4.2 to Address Critical Remote Attack Vulnerability
WordPress has released version 6.4.2 with a patch for a critical security flaw that could be exploited by threat actors by combining it with another bug to execute arbitrary PHP code on vulnerable sites. "A remote code execution vulnerability that is not directly exploitable in core; however, the...
Deserialization of arbitrary data leads to RCE
Description LibreNMS includes support for monitoring applications, one of which is memcached. When polling for memcached, the data returned by the agent to the LibreNMS server is not verified before it is deserialized. Because LibreNMS has quite a few dependencies, it is easy to find a working...
Laravel Framework RCE Vulnerability
In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unserialize call on a potentially untrusted X-XSRF-TOKEN value. This involves the decrypt method in Illuminate/Encryption/Encrypter.php and PendingBroadcast in...
Deserialization of untrusted data
SuiteCRM through 7.12.1 and 8.x through 8.0.1 allows Remote Code Execution. Authenticated users with access to the Scheduled Reports module can achieve this by leveraging PHP deserialization in the emailrecipients property. By using a crafted request, they can create a malicious report, containin...
