CVE-2023-23924

CVE-2023-23924 Dompdf は SVG 解析時に URI 検証に失敗する脆弱性があります · CVE-2023-23924 · GitHub Advisory Database https://github.com/advisories/GHSA-3cw5-7cxw-v5qg 実行 root@kitploit: Terminal 1 ❯ cd www ❯ php -S 127.0.0.1:9000 -t . Terminal 2 ❯ cd src ❯ php cve202323924.php 確認 「whoami」コマンドが実行されていることを確認します。 2.0.1...

CVE-2022-41343

registerFont in FontMetrics.php in Dompdf before 2.0.1 allows remote file inclusion because a URI validation failure does not halt font registration, as demonstrated by a @font-face rule...

CVE-2023-23924 URI validation failure on SVG parsing in Dompdf

Dompdf is an HTML to PDF converter. The URI validation on dompdf 2.0.1 can be bypassed on SVG parsing by passing tags with uppercase letters. This may lead to arbitrary object unserialize on PHP 8, through the phar URL wrapper. An attacker can exploit the vulnerability to call arbitrary URL with...

CVE-2022-41343

registerFont in FontMetrics.php in Dompdf before 2.0.1 allows remote file inclusion because a URI validation failure does not halt font registration, as demonstrated by a @font-face rule...