VHCS 2.4.7.1 - 'vhcs2_daemon' Remote Code Execution

!/usr/bin/php -q http://acid-root.new.fr/ [email protected] Exploit: + Logged in Administrator + The administrator has 2 resellers / Changing dareseller's password / Trying to connect as dareseller:thatpwnz + Login successful + The reseller has 2 users + Host domaintest.fr is connected /...

Code injection

curl/interface.c in the cURL library aka libcurl in PHP 5.2.4 and 5.2.5 allows context-dependent attackers to bypass safemode and openbasedir restrictions and read arbitrary files via a file:// request containing a \x00 sequence, a different vulnerability than CVE-2006-2563...

CVE-2007-4850

curl/interface.c in the cURL library aka libcurl in PHP 5.2.4 and 5.2.5 allows context-dependent attackers to bypass safemode and openbasedir restrictions and read arbitrary files via a file:// request containing a \x00 sequence, a different vulnerability than CVE-2006-2563...

CVE-2007-4850

CVE-2007-4850 affects PHP with libcurl (curl/interface.c) in PHP 5.2.4 and 5.2.5, where a file:// request containing a NULL sequence can bypass safe_mode and open_basedir and read arbitrary files. The vulnerability is linked to PHP’s libcurl handling and is reflected in OpenVAS entries for PHP

PHP -> set_time_limit

when safemode = on, settimelimit is "off", then we can use iniset"maxexecutiontime", 90000000; suppose the server is vulnerable PHP injection, then an attacker make a backdoor in PHP and register it in SCM of windows with win32service extension. the backdoor need wait for connections, if safemode...

Design/Logic Flaw

The Component Object Model COM functions in PHP 5.x on Windows do not follow safemode and disablefunctions restrictions, which allows context-dependent attackers to bypass intended limitations, as demonstrated by executing objects with the kill bit set in the corresponding ActiveX control...

CVE-2007-5653

The CVE-2007-5653 entry concerns PHP 5.x on Windows where COM functions do not honor safe_mode or disable_functions, enabling context-dependent bypass of intended restrictions. The description cites concrete examples related to com_load_typelib and interactions with ActiveX/Windows components suc...

PHP 5.x COM functions safe_mode and disable_function bypass

No description provided by source. ?php //PHP 5.x COM functions safemode and disablefunction bypass //author: shinnai //mail: shinnaiatautisticidotorg //site: http://shinnai.altervista.org //dork: intitle:phpinfo intext:"php version" +windows thanks to rgod...

php5x-bypass.txt

sounds good //The windows version of PHP has built in support for this extension. You do not need to //load any additional extension in order to use these functions. //You are responsible for installing support for the various COM objects that you intend //to use such as MS Word; we don't and can...

openSUSE 10 Security Update : php5 (php5-3745)

The following issues have been fixed in PHP, which were spotted by the MOPB project or fixed in PHP 5.2.3 release : - missing openbasedir and safemode restriction CVE-2007-3007 - chunksplit integer overflow CVE-2007-2872 - DoS condition in libgd's image processing CVE-2007-2756 - possible...

CVE-2007-5447

ioncubeloaderwin5.2.dll in the ionCube Loader 6.5 extension for PHP 5.2.4 does not follow safemode and disablefunctions restrictions, which allows context-dependent attackers to bypass intended limitations, as demonstrated by reading arbitrary files via the ioncubereadfile function...

CVE-2007-5447

ioncubeloaderwin5.2.dll in the ionCube Loader 6.5 extension for PHP 5.2.4 does not follow safemode and disablefunctions restrictions, which allows context-dependent attackers to bypass intended limitations, as demonstrated by reading arbitrary files via the ioncubereadfile function...

PHP 5.2.4 ionCube extension safe_mode / disable_functions Bypass

Exploit for unknown platform in category local exploits ================================================================ PHP 5.2.4 ionCube extension safemode / disablefunctions Bypass ================================================================ ionCub...

CVE-2007-4889

The CVE-2007-4889 entry relates to PHP’s MySQL extension in PHP 5.2.4 and earlier, where remote attackers could bypass safe_mode and open_basedir restrictions using MySQL functions (LOAD_FILE, INTO DUMPFILE, INTO OUTFILE). Affected component: PHP MySQL extension (versions

FreeBSD : php -- multiple vulnerabilities (71d903fc-602d-11dc-898c-001921ab2fa4)

The PHP development team reports : Security Enhancements and Fixes in PHP 5.2.4 : - Fixed a floating point exception inside wordwrap Reported by Mattias Bengtsson - Fixed several integer overflows inside the GD extension Reported by Mattias Bengtsson - Fixed size calculation in chunksplit Reporte...

PHP MySQL/MySQLi扩展绕过安全限制漏洞

CVECAN ID: CVE-2007-3997 PHP是广泛使用的通用目的脚本语言，特别适合于Web开发，可嵌入到HTML中。 PHP的MySQL和MySQLi扩展在处理畸形数据的SQL请求时，远程攻击者可能利用此漏洞执行SQL注入攻击。 PHP的MySQL和MySQLi扩展没有正确地处理包含有LOCAL INFILE的SQL查询请求，如果远程攻击者向安装了这些扩展的服务器提交了恶意SQL请求的话，就可以绕过openbasedir和safemode安全限制，执行非授权操作。请注意不要依赖于共享主机MySQLd local-infile=0选项，因为这个选项是服务器选项，因此不会影响客户...

Design/Logic Flaw

The 1 MySQL and 2 MySQLi extensions in PHP 4 before 4.4.8, and PHP 5 before 5.2.4, allow remote attackers to bypass safemode and openbasedir restrictions via MySQL LOCAL INFILE operations, as demonstrated by a query with LOAD DATA LOCAL INFILE...

CVE-2007-3997

The 1 MySQL and 2 MySQLi extensions in PHP 4 before 4.4.8, and PHP 5 before 5.2.4, allow remote attackers to bypass safemode and openbasedir restrictions via MySQL LOCAL INFILE operations, as demonstrated by a query with LOAD DATA LOCAL INFILE...

EUVD-2007-3981

The 1 MySQL and 2 MySQLi extensions in PHP 4 before 4.4.8, and PHP 5 before 5.2.4, allow remote attackers to bypass safemode and openbasedir restrictions via MySQL LOCAL INFILE operations, as demonstrated by a query with LOAD DATA LOCAL INFILE...

CVE-2007-4596

The perl extension in PHP does not follow safemode restrictions, which allows context-dependent attackers to execute arbitrary code via the Perl eval function. NOTE: this might only be a vulnerability in limited environments...