nanwinata-CVE-2024-52301

Script de détection de la vulnérabilité Laravel CVE-2024-13918 Ce script utilise des outils simples : subfinder, httpx. Laravel est un framework d'application web. Lorsque la directive PHP registerargcargv est activée et que les utilisateurs appellent une URL avec une chaîne de requête spécialeme...

CVE-2024-50340

CVE-2024-50340 إثبات المفهوم المتطلبات يجب تمكين خيار registerargcargv في ملف تكوين PHP php.ini. يقوم هذا الإعداد بتحميل وسائط سطر الأوامر ومعلمات الاستعلام إلى $SERVER'argv'. https://www.php.net/manual/en/ini.core.phpini.register-argc-argv شرح الكود القابل للاستغلال يستخدم كود Symfony هذا وسائط...

CVE-2024-52301

Preuve de Concept CVE-2024-52301 Cette vulnérabilité est basée sur la vulnérabilité CVE-2024-50340 Prérequis L'option registerargcargv doit être activée dans le fichier de configuration PHP php.ini. Ce paramètre charge les arguments de la ligne de commande et les paramètres de requête dans...

CVE-2024-29895

CVE-2024-29895 Cacti CVE-2024-29895 POC ثغرة حقن أوامر تسمح لأي مستخدم غير مصادق بتنفيذ أوامر عشوائية على الخادم عندما يكون خيار registerargcargv في PHP مفعّلاً. https://github.com/Cacti/cacti/security/advisories/GHSA-cr28-x256-xf5m الاستخدام: app -m http://site.com/ -c whoami أو: app -w...

CVE-2024-52301-Research

بحث حول CVE-2024-52301 بحث صغير حول CVE-2024-52301. رأيت الثغرة وأردت معرفة كيف يمكن أن يكون Laravel عرضة لها. لهذا، قمت ببساطة بمقارنة الإصدارين 6.20.44 و6.20.45، وتتبعت كيف يمكن لمعاملات GET أن تنتهي بتغيير إعدادات التطبيق. لقد كتبت عن هذا على X وBlueSky:...

craft-cms-RCE-CVE-2024-56145

craft-cms-RCE-CVE-2024-56145 Un environnement de laboratoire POC pour CVE-2024-56145 CraftCMS RCE. Description de la vulnérabilité Une vulnérabilité RCE potentielle a été découverte dans craftCMS si l'option registerargcargv est activée dans php.ini. Il s'agit d'un environnement de laboratoire PO...

Linux Distros Unpatched Vulnerability : CVE-2024-29895

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cacti provides an operational monitoring and fault management framework. A command injection vulnerability on the 1.3.x DEV branch allows any unauthenticated us...

VulnCheck KEV: CVE-2024-52301

Laravel is a web application framework. When the registerargcargv php directive is set to on , and users call any URL with a special crafted query string, they are able to change the environment used by the framework when handling the request. The vulnerability fixed in 6.20.45, 7.30.7, 8.83.28,...

CVE-2024-56145

Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Users of affected versions are affected by this vulnerability if their php.ini configuration has "registerargcargv" enabled. For these users an unspecified remote code execution vector is present...

CVE-2024-56145 RCE when PHP `register_argc_argv` config setting is enabled in craftcms/cms

Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Users of affected versions are affected by this vulnerability if their php.ini configuration has registerargcargv enabled. For these users an unspecified remote code execution vector is present...

CVE-2024-56145

Craft CMS is affected by CVE-2024-56145 due to a code execution vector triggered when php.ini register_argc_argv is enabled. Reports indicate an RCE vulnerability exists in affected versions, with remediation via upgrading to Craft CMS 3.9.14, 4.13.2, or 5.5.2. If upgrading is not possible, the r...

CVE-2024-56145 RCE when PHP `register_argc_argv` config setting is enabled in craftcms/cms

Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Users of affected versions are affected by this vulnerability if their php.ini configuration has registerargcargv enabled. For these users an unspecified remote code execution vector is present...

CVE-2024-56145 RCE when PHP `register_argc_argv` config setting is enabled in craftcms/cms

Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Users of affected versions are affected by this vulnerability if their php.ini configuration has registerargcargv enabled. For these users an unspecified remote code execution vector is present...

GHSA-2P6P-9RC9-62J9 Craft CMS has potential RCE when PHP `register_argc_argv` config setting is enabled

Impact You are affected if your php.ini configuration has registerargcargv enabled. Patches Update to 3.9.14, 4.13.2, or 5.5.2. Workarounds If you can't upgrade yet, and registerargcargv is enabled, you can disable it to mitigate the issue...

CVE-2024-56145: Improper Control of Generation of Code

Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Users of affected versions are affected by this vulnerability if their php.ini configuration has registerargcargv enabled. For these users an unspecified remote code execution vector is present...

The vulnerability of the `register_argc_argv` configuration in the PHP framework Laravel allows attackers to compromise the integrity of the protected information.

The vulnerability in the registerargcargv configuration in the Laravel PHP framework is related to the improper elimination of arguments separators in the command. Exploiting this vulnerability allows an attacker to compromise the integrity of the protected information from a remote location...

CVE-2024-52301

Laravel is a web application framework. When the registerargcargv php directive is set to on , and users call any URL with a special crafted query string, they are able to change the environment used by the framework when handling the request. The vulnerability fixed in 6.20.45, 7.30.7, 8.83.28,...

CVE-2024-52301

The Laravel web application framework is vulnerable to an environment manipulation flaw when the register_argc_argv PHP directive is enabled. An attacker can provide a specially crafted query string in a URL to inject arguments, allowing them to change the environment used by the framework during...

CVE-2024-52301: Improper Neutralization of Argument Delimiters in a Command

Laravel is a web application framework. When the registerargcargv php directive is set to on , and users call any URL with a special crafted query string, they are able to change the environment used by the framework when handling the request. The vulnerability fixed in 6.20.45, 7.30.7, 8.83.28,...

VulnCheck KEV: CVE-2024-29895

Cacti provides an operational monitoring and fault management framework. A command injection vulnerability on the 1.3.x DEV branch allows any unauthenticated user to execute arbitrary command on the server when registerargcargv option of PHP is On. In cmdrealtime.php line 119, the $pollerid used ...