cacti-cve-2022-46169-exploit

CVE-2022-46169 PoC: 認証バイパスおよびリモートコード実行 このリポジトリには、CVE-2022-46169 脆弱性の PoC が含まれています。この脆弱性により、攻撃者は認証をバイパスし、影響を受けるシステム上でリモートから任意のコードを実行できます。この脆弱性は、2022年8月18日にリリースされた Cacti バージョン 1.2.22 に影響します。 脆弱性は、remoteagent.php に IP アドレスを取得し poller テーブル内のエントリを検証する関数が存在することに起因します。エントリが見つかると、関数は true...

CVE-2024-1874

CVE-2024-1874 CVE-2024-1874 の概念実証 procopen の配列形式の $command パラメータを介したコマンドインジェクション（CVE-2024-1874 修正の回避） The CVE: PHP バージョン 8.1. の 8.1.29 未満、8.2. の 8.2.20 未満、8.3. の 8.3.8 未満において、CVE-2024-1874 の修正は、コマンド名に末尾のスペースが含まれる場合に機能しません。元の問題: procopen...

CVE-2026-63722

ICEcoder 8.1 contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary OS commands by chaining an authentication bypass, CSRF validation bypass, and unsanitized command execution. Attackers can send a single HTTP POST request to the...

CVE-2026-63722 ICEcoder 8.1 Unauthenticated RCE via terminal-xhr.php

ICEcoder 8.1 contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary OS commands by chaining an authentication bypass, CSRF validation bypass, and unsanitized command execution. Attackers can send a single HTTP POST request to the...

CVE-2026-63722

ICEcoder 8.1 is vulnerable to unauthenticated remote code execution via the terminal-xhr.php endpoint. Attackers chain three flaws: a password parameter bypasses authentication, a non-empty csrf parameter skips CSRF validation, and an arbitrary command string is passed directly to proc_open(), yi...

EUVD-2026-62698

ICEcoder 8.1 contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary OS commands by chaining an authentication bypass, CSRF validation bypass, and unsanitized command execution. Attackers can send a single HTTP POST request to the...

CVE-2026-63722 ICEcoder 8.1 Unauthenticated RCE via terminal-xhr.php

ICEcoder 8.1 contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary OS commands by chaining an authentication bypass, CSRF validation bypass, and unsanitized command execution. Attackers can send a single HTTP POST request to the...

PT-2026-78586

Name of the Vulnerable Software and Affected Versions ICEcoder version 8.1 Description An unauthenticated remote code execution issue allows attackers to execute arbitrary OS commands by chaining an authentication bypass, CSRF Cross-Site Request Forgery validation bypass, and unsanitized command...

CVE-2026-46394

CVE-2026-46394 : HAX CMS PHP backend prior to v26.0.0 is vulnerable to OS command injection in the Git.php library. The application builds shell commands from unsanitized input and executes them via proc_open(); only one of 17 command-invoking functions uses escapeshellarg(), increasing risk. An ...

EUVD-2024-46774

Malicious code in bioql PyPI...

The vulnerability of the proc_open() function in the PHP interpreter allows attackers to execute arbitrary commands.

The vulnerability of the procopen function in the PHP programming language exists because measures to neutralize the special elements used in operating system commands have not been implemented. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

BIT-LIBPHP-2024-5585 Command injection via array-ish $command parameter of proc_open() (bypass CVE-2024-1874 fix)

In PHP versions 8.1. before 8.1.29, 8.2. before 8.2.20, 8.3. before 8.3.8, the fix for CVE-2024-1874 does not work if the command name includes trailing spaces. Original issue: when using procopen command with array syntax, due to insufficient escaping, if the arguments of the executed command ar...

BIT-PHP-MIN-2024-1874 Command injection via array-ish $command parameter of proc_open()

In PHP versions 8.1. before 8.1.28, 8.2. before 8.2.18, 8.3. before 8.3.5, when using procopen command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands ...

BIT-PHP-MIN-2024-5585 Command injection via array-ish $command parameter of proc_open() (bypass CVE-2024-1874 fix)

In PHP versions 8.1. before 8.1.29, 8.2. before 8.2.20, 8.3. before 8.3.8, the fix for CVE-2024-1874 does not work if the command name includes trailing spaces. Original issue: when using procopen command with array syntax, due to insufficient escaping, if the arguments of the executed command ar...

The vulnerability of the proc_open() function in the PHP interpreter allows attackers to execute arbitrary commands.

The vulnerability of the procopen function in the PHP programming language exists because measures to neutralize the special elements used in operating system commands have not been taken. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

CBL Mariner 2.0 Security Update: php (CVE-2024-1874)

The version of php installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-1874 advisory. - In PHP versions 8.1. before 8.1.28, 8.2. before 8.2.18, 8.3. before 8.3.5, when using procopen command with arra...

Command injection via array-ish $command parameter of proc_open() (bypass CVE-2024-1874 fix)

...

Improper Encoding Or Escaping Of Output

php81 is vulnerable to Improper Encoding or Escaping of Output. The vulnerability is due to insufficient escaping when using the procopen command with array syntax, allowing malicious users to execute arbitrary commands in the Windows shell by supplying controlled arguments...

BIT-PHP-2024-5585 Command injection via array-ish $command parameter of proc_open() (bypass CVE-2024-1874 fix)

In PHP versions 8.1. before 8.1.29, 8.2. before 8.2.20, 8.3. before 8.3.8, the fix for CVE-2024-1874 does not work if the command name includes trailing spaces. Original issue: when using procopen command with array syntax, due to insufficient escaping, if the arguments of the executed command ar...

CVE-2024-5585

In PHP, the fix for CVE-2024-1874 does not work if the command name includes trailing spaces. Original issue: when using procopen command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments tha...