An SQL injection vulnerability exists in the DBSHOP_0.9.3_Beta getQuery() function.

DBShop is an open source e-commerce online store system developed using endFramework. DBSHOP0.9.3Beta suffers from SQL injection vulnerability. Due to the /DBSHOP/module/Shopfront/src/Shopfront/Controller/GoodslistController.php at indexAction first through getQuery to get all the parameters,...

Internet Bug Bounty: Use-after-free in unserialize()

The bug report at: https://bugs.php.net/bug.php?id=73147 The fix commit at: https://github.com/php/php-src/commit/0e6fe3a4c96be2d3e88389a5776f878021b4c59f...

Tuleap PHP Unserialize Code Execution (CVE-2014-8791)

This module exploits a PHP object injection vulnerability. Tuelap could be abused to allow authenticated users to execute arbitrary code with the permissions of the web server. This could lead to execute PHP code on the server...

SugarCRM REST deserialization vulnerability

Added: 09/23/2016 BID: 91413 Background SugarCRM is customer relationship management software written in PHP. Problem Improper use of the unserialize function inside the SugarRestSerialize.php script allows remote attackers to inject PHP objects, leading to arbitrary command execution. Resolution...

CVE-2016-7411

ext/standard/varunserializer.re in PHP before 5.6.26 mishandles object-deserialization failures, which allows remote attackers to cause a denial of service memory corruption or possibly have unspecified other impact via an unserialize call that references a partially constructed object...

Internet Bug Bounty: wddx_deserialize use-after-free

Upstream Bug --- https://bugs.php.net/bug.php?id=72860 Summary -- wddxdeserialize allows to unserialize a WDDX packet that usually comes from external input. While WDDX tries to deserialize "recordset" element, use-after-free happens if the close tag for the field is not found. Patch --...

php: multiple issues

CVE-2016-7411 arbitrary code execution A memory Corruption vulnerability was found in php's unserialize method. This happened during the deserialized-object Destruction. - CVE-2016-7412 arbitrary code execution Php's mysqlnd extension assumes the flags returned for a BIT field necessarily...

CVE-2016-7411

ext/standard/varunserializer.re in PHP before 5.6.26 mishandles object-deserialization failures, which allows remote attackers to cause a denial of service memory corruption or possibly have unspecified other impact via an unserialize call that references a partially constructed object...

CVE-2016-7411

ext/standard/varunserializer.re in PHP before 5.6.26 mishandles object-deserialization failures, which allows remote attackers to cause a denial of service memory corruption or possibly have unspecified other impact via an unserialize call that references a partially constructed object...

PT-2016-3383

Name of the Vulnerable Software and Affected Versions PHP versions prior to 5.6.26 Description The issue is related to the mishandling of object-deserialization failures in the ext/standard/var unserializer.re component of PHP. This could allow remote attackers to cause a denial of service memory...

CVE-2016-7411: Improper Restriction of Operations within the Bounds of a Memory Buffer

ext/standard/varunserializer.re in PHP before 5.6.26 mishandles object-deserialization failures, which allows remote attackers to cause a denial of service memory corruption or possibly have unspecified other impact via an unserialize call that references a partially constructed object...

CS-Cart add-on "Twigmo" vulnerable to PHP object injection

Overview CS-Cart add-on "Twigmo" contains a PHP object injection vulnerability due to a flaw where untrusted input values are unserialized. ASAI Ken reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact A remote...

SugarCRM 6.5.23 - REST PHP Object Injection Exploit (Metasploit)

Exploit for php platform in category remote exploits This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'SugarCRM REST Unserialize PHP Code Execution', 'Description' = %q This...

SugarCRM 6.5.23 - REST PHP Object Injection (Metasploit)

SugarCRM 6.5.23 - REST PHP Object Injection Metasploit This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'SugarCRM REST Unserialize PHP Code Execution', 'Description' = %q This...

PHP 'unserialize()' memory error references remote command execution vulnerability

PHP is an open source general-purpose computer scripting language. PHP 'unserialize' suffers from a memory error referencing a remote command execution vulnerability, which allows an attacker to exploit the vulnerability to execute arbitrary code in the context of a user's affected application,...

Internet Bug Bounty: wddx_deserialize null dereference with invalid xml

Upstream Bug --- 2016-08-09 02:53 UTC https://bugs.php.net/bug.php?id=72790 Summary -- wddxdeserialize allows to unserializes a WDDX packet that usually comes from external input, php interpreter crashes while processing invalid XML input with wddxdeserialize...

Internet Bug Bounty: Use After Free Vulnerability in unserialize()

bug report at: https://bugs.php.net/bug.php?id=70436 fix commit at: https://github.com/php/php-src/commit/95d09e4b5e6b84f8340efe03e8e2f9c1380228db Use After Free Vulnerability in unserialize Taoguang Chen - Write Date: 2015.9.6 - Release Date: 2016.8.18 A use-after-free vulnerability was discover...

Silver Stripe CMS: source code security analysis report

Several vulnerabilities were discovered in SilverStripe Limited 'Silver Stripe CMS' software: Incorrect User Input Filtration when Connecting to External Files File System Path Manipulation Using Global Variables Incorrect User Input Filtration when Using the unserialize Function Incorrect Newlin...

Design/Logic Flaw

phpzip.c in the zip extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 improperly interacts with the unserialize implementation and garbage collection, which allows remote attackers to execute arbitrary code or cause a denial of service use-after-free and application crash...

Design/Logic Flaw

splarray.c in the SPL extension in PHP before 5.5.37 and 5.6.x before 5.6.23 improperly interacts with the unserialize implementation and garbage collection, which allows remote attackers to execute arbitrary code or cause a denial of service use-after-free and application crash via crafted...