1346 matches found
PHP unserialize() function information leak
Uninitiailized memory fragment is returned on "S:" string...
MOPB-29-2007:PHP 5.2.1 unserialize() Information Leak Vulnerability
Summary The new S: data type added to PHP 5.2.1's serialisation format is completely broken. The new feature it is supposed to add, the handling of escaped strings does not work at all and leads to disclosure of heap memory content. Affected versions Affected is PHP 5.2.1 Detailed information Wit...
MOPB-unserialize.txt
1,strrepeat'"', 200."2"=1; $heapdump = unserialize$str; echo "Heapdump\n---------\n\n"; $len = strlen$heapdump; for $b=0; $b 127 || $c...
PHP 5.2.1 unserialize() Local Information Leak Exploit
No description provided by source. ?php //////////////////////////////////////////////////////////////////////// // // // | || | | | | | | | || || \ // // | |/ || '|/ |/ -| ' \ / -/ |||| /| || / //...
PHP 5.2.1 - Unserialize() Local Information Leak
PHP 5.2.1 - Unserialize Local Information Leak 1,strrepeat'"', 200."2"=1; $heapdump = unserialize$str; echo "Heapdump\n---------\n\n"; $len = strlen$heapdump; for $b=0; $b$len; $b+=16 printf"%08x: ", $b; for $i=0; $i16; $i++ if $b+$i$len printf "%02x ", ord$heapdump$b+$i; else printf "...
PHP 5.2.1 unserialize() Local Information Leak Exploit
Exploit for multiple platform in category local exploits ====================================================== PHP 5.2.1 unserialize Local Information Leak Exploit ====================================================== 1,strrepeat'"', 200."2"=1; $heapdump = unserialize$str; echo...
PHP 5.2.1 - 'Unserialize()' Local Information Leak
1,strrepeat'"', 200."2"=1; $heapdump = unserialize$str; echo "Heapdump\n---------\n\n"; $len = strlen$heapdump; for $b=0; $b$len; $b+=16 printf"%08x: ", $b; for $i=0; $i16; $i++ if $b+$i$len printf "%02x ", ord$heapdump$b+$i; else printf ".. "; for $i=0; $i16; $i++ if $b+$i$l...
Integer overflow
Integer overflow in PHP 4.4.4 and earlier allows remote context-dependent attackers to execute arbitrary code via a long string to the unserialize function, which triggers the overflow in the ZVAL reference counter...
CVE-2007-1286
Integer overflow in PHP 4.4.4 and earlier allows remote context-dependent attackers to execute arbitrary code via a long string to the unserialize function, which triggers the overflow in the ZVAL reference counter...
PHP <= 4.4.4 unserialize() ZVAL Reference Counter Overflow Exploit PoC
No description provided by source. ?php //////////////////////////////////////////////////////////////////////// // // // | || | | | | | | | || || // // | |/ || '|/ |/ -| ' / -/ |||| /| || / //...
PHP <= 4.4.4 unserialize() ZVAL Reference Counter Overflow Exploit PoC
No description provided by source. ?php //////////////////////////////////////////////////////////////////////// // // // | || | | | | | | | || || \ // // | |/ || '|/ |/ -| ' \ / -/ |||| /| || / // // ||||,||| ,|||||||,| || |||||| // // // // Proof of concept code from the Hardened-PHP...
MOPB-04-2007:PHP 4 unserialize() ZVAL Reference Counter Overflow
Summary The Month of PHP Bugs started with one of the possible ways to exploit the 16bit reference counter of PHP 4. It was only exploitable with local access. However because PHP does not protect against these overflows anywhere there are other exploit vectors. With unserialize it is triggerable...
PHP <= 4.4.4 unserialize() ZVAL Reference Counter Overflow Exploit PoC
Exploit for linux platform in category dos / poc ====================================================================== PHP = 4.4.4 unserialize ZVAL Reference Counter Overflow Exploit PoC ====================================================================== ?php...
MOPB-05-2007:PHP unserialize() 64 bit Array Creation Denial of Service Vulnerability
Summary A user supplied serialized string might trigger on 64 bit systems a tight endless loop within zendhashinit exhausting CPU ressources. Affected versions Affected is PHP 4.4.4/5.2.0 and below. Detailed information Before PHP 4.3.11 was released it was discovered that there is a problem in t...
PHP unserialize() integer overflow
16-bit counter overflow leads to ability of code execution on parsing cookie...
PHP 4.4.4 - Unserialize() ZVAL Reference Counter Overflow (PoC)
PHP 4.4.4 - Unserialize ZVAL Reference Counter Overflow PoC ?php //////////////////////////////////////////////////////////////////////// // // // | || | | | | | | | || || \ // // | |/ || '|/ |/ -| ' \ / -/ |||| /| || / // // ||||,||| ,|||||||,| || |||||| // // // // Proof of concept code...
PHP 4.4.4 - 'Unserialize()' ZVAL Reference Counter Overflow (PoC)
?php //////////////////////////////////////////////////////////////////////// // // // | || | | | | | | | || || \ // // | |/ || '|/ |/ -| ' \ / -/ |||| /| || / // // ||||,||| ,|||||||,| || |||||| // // // // Proof of concept code from the Hardened-PHP Project // // C Copyright 2007 Stefan...
PHP 4.5.0 - Unserialize Overflow (Metasploit)
PHP 4.5.0 - Unserialize Overflow Metasploit $Id$ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ requir...
PHP < 4.5.0 unserialize Overflow
No description provided by source. $Id$ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require...
PHP < 4.5.0 - Unserialize Overflow (Metasploit)
$Id$ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 'PHP 4...