exploit the possibilities
Showing 1 - 25 of 4,748 RSS Feed

PHP Files

PEAR Archive_Tar PHP Object Injection
Posted Jan 10, 2019
Authored by farisv

PEAR Archive_Tar versions prior to 1.4.4 suffers from a php object injection vulnerability.

tags | exploit, php
advisories | CVE-2018-1000888
MD5 | 301d1addd2f16d82750f17ee54102420
SugarCRM Web Logic Hooks Module Path Traversal
Posted Jan 1, 2019
Authored by EgiX | Site karmainsecurity.com

SugarCRM versions prior to 7.9.5.0, 8.0.2, and 8.2.0 suffer from a path traversal vulnerability. User input passed through the "webhook_target_module" parameter is not properly sanitized before being used to save PHP code into the hooks file through the Web Logic Hooks module. This can be exploited to carry out path traversal attacks and e.g. create arbitrary directories. Successful exploitation of this vulnerability requires admin privileges.

tags | exploit, web, arbitrary, php
MD5 | 0a73c52a5465fdc38ae3bede2f424098
SugarCRM Web Logic Hooks Module PHP Code Injection
Posted Jan 1, 2019
Authored by EgiX | Site karmainsecurity.com

SugarCRM versions prior to 7.9.5.0, 8.0.2, and 8.2.0 suffer from a PHP code injection vulnerability. User input passed through the "trigger_event" parameter is not properly sanitized before being used to save PHP code into the 'logic_hooks.php' file through the Web Logic Hooks module. This can be exploited to inject and execute arbitrary PHP code. Successful exploitation of this vulnerability requires admin privileges.

tags | exploit, web, arbitrary, php
MD5 | bc08aaf51fef23154d37431b75e27168
SugarCRM addLabels PHP Code Injection
Posted Jan 1, 2019
Authored by EgiX | Site karmainsecurity.com

SugarCRM versions prior to 7.9.5.0, 8.0.2, and 8.2.0 suffer from a PHP code injection vulnerability. User input passed through key values of the 'labels_' parameters is not properly sanitized before being used to save PHP code within the "ParserLabel::addLabels()" method when saving labels through the Module Builder. This can be exploited to inject and execute arbitrary PHP code. Successful exploitation of this vulnerability requires admin privileges.

tags | exploit, arbitrary, php
MD5 | a185f42ec61a0417ce4c9024f155944a
SugarCRM WorkFlow PHP Code Injection
Posted Jan 1, 2019
Authored by EgiX | Site karmainsecurity.com

SugarCRM versions prior to 7.9.4.0 and 7.11.0.0 suffer from a PHP code injection vulnerability in the WorkFlow module. User input passed through the $_POST['base_module'] parameter to the "Save" action of the WorkFlow module is not properly sanitized before being used to write data into the 'workflow.php' file. This can be exploited to inject and execute arbitrary PHP code. Successful exploitation of this vulnerability requires admin privileges.

tags | exploit, arbitrary, php
MD5 | 695389da1dad0e4c2419d379b1d1e132
SugarCRM SaveDropDown PHP Code Injection
Posted Jan 1, 2019
Authored by EgiX | Site karmainsecurity.com

SugarCRM versions prior to 7.9.5.0, 8.0.2, and 8.2.0 suffer from a PHP code injection vulnerability. User input passed through key values of the 'list_value' JSON parameter is not properly sanitized before being used to save PHP code when adding/saving dropdowns through the Module Builder. This can be exploited to inject and execute arbitrary PHP code. Successful exploitation of this vulnerability requires admin privileges.

tags | exploit, arbitrary, php
MD5 | d7144a03e522ca3b40f5f45efbaea7dd
How To Exploit PHP Remotely To Bypass Filters And WAF Rules
Posted Dec 25, 2018
Authored by themiddleblue

Whitepaper called How to Exploit PHP Remotely to Bypass Filters and WAF Rules.

tags | paper, php
MD5 | 951bbbe0ecb41f1c347de656c6715e7e
WordPress Snap Creek Duplicator Code Injection
Posted Dec 12, 2018
Authored by Thomas Chauchefoin, Julien Legras | Site metasploit.com

When the WordPress plugin Snap Creek Duplicator restores a backup, it leaves dangerous files in the filesystem such as installer.php and installer-backup.php. These files allow anyone to call a function that overwrite the wp-config.php file AND this function does not sanitize POST parameters before inserting them inside the wp-config.php file, leading to arbitrary PHP code execution. WARNING: This exploit WILL break the wp-config.php file. If possible try to restore backups of the configuration after the exploit to make the WordPress site work again.

tags | exploit, arbitrary, php, code execution
advisories | CVE-2018-17207
MD5 | 3e9bb4227872fd85077a0576d93fc20f
PHP Source Code Analysis
Posted Dec 12, 2018
Authored by Engin Demirbilek

Whitepaper called PHP Source Code Analysis. Written in Turkish.

tags | paper, php
MD5 | 541f02d58c221e424f1e880cec6cd567
Debian Security Advisory 4353-1
Posted Dec 11, 2018
Authored by Debian | Site debian.org

Debian Linux Security Advisory 4353-1 - Multiple security issues were found in PHP, a widely-used open source denial of service/information disclosure when parsing malformed images, the Apache module allowed cross-site-scripting via the body of a insufficient input validation which can result in the execution of arbitrary shell commands in the imap_open() function and denial of service in the imap_mail() function.

tags | advisory, denial of service, arbitrary, shell, php, info disclosure
systems | linux, debian
advisories | CVE-2018-14851, CVE-2018-14883, CVE-2018-17082, CVE-2018-19518, CVE-2018-19935
MD5 | d9b1a99e04d2c1e6335bb4aef129d5a1
Slackware Security Advisory - php Updates
Posted Dec 11, 2018
Authored by Slackware Security Team | Site slackware.com

Slackware Security Advisory - New php packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix security issues.

tags | advisory, php
systems | linux, slackware
MD5 | a1bcb0ddb933e7f43392915dd032cfe1
Debian Security Advisory 4351-1
Posted Dec 8, 2018
Authored by Debian | Site debian.org

Debian Linux Security Advisory 4351-1 - It was discovered that PHPMailer, a library to send email from PHP applications, is prone to a PHP object injection vulnerability, potentially allowing a remote attacker to execute arbitrary code.

tags | advisory, remote, arbitrary, php
systems | linux, debian
advisories | CVE-2018-19296
MD5 | caddae86ea0cbb47f309c50d59d72537
PHP Server Monitor 3.3.1 Cross Site Request Forgery
Posted Dec 4, 2018
Authored by Javier Olmedo

PHP Server Monitor version 3.3.1 suffers from a cross site request forgery vulnerability.

tags | exploit, php, csrf
MD5 | 5fe1c2f708db2fb89bc73606a4894920
Gentoo Linux Security Advisory 201812-01
Posted Dec 3, 2018
Authored by Gentoo | Site security.gentoo.org

Gentoo Linux Security Advisory 201812-1 - Multiple vulnerabilities have been found in PHP, the worst of which could result in a Denial of Service condition. Multiple versions are affected.

tags | advisory, denial of service, php, vulnerability
systems | linux, gentoo
advisories | CVE-2018-10545, CVE-2018-10546, CVE-2018-10548, CVE-2018-10549, CVE-2018-17082
MD5 | 855d25fbb1fcefb9b726efaee310ece2
PHP imap_open Remote Code Execution
Posted Nov 28, 2018
Authored by h00die, Anton Lopanitsyn, Twoster | Site metasploit.com

The imap_open function within PHP, if called without the /norsh flag, will attempt to preauthenticate an IMAP session. On Debian based systems, including Ubuntu, rsh is mapped to the ssh binary. Ssh's ProxyCommand option can be passed from imap_open to execute arbitrary commands. While many custom applications may use imap_open, this exploit works against the following applications: e107 v2, prestashop, SuiteCRM, as well as Custom, which simply prints the exploit strings for use. Prestashop exploitation requires the admin URI, and administrator credentials. suiteCRM/e107/hostcms require administrator credentials.

tags | exploit, arbitrary, php, imap
systems | linux, debian, ubuntu
MD5 | d4da49f1f3382fe81325e51853a7fcc3
PHP-Proxy 5.1.0 Local File Inclusion
Posted Nov 15, 2018
Authored by Ameer Pornillos

PHP-Proxy version 5.1.0 suffers from a local file inclusion vulnerability.

tags | exploit, local, php, file inclusion
advisories | CVE-2018-19246
MD5 | 96c23b5c4ac90b08c6b144a53cf3862d
PHP Mass Mail 1.0 Shell Upload
Posted Nov 15, 2018
Authored by Ihsan Sencan

PHP Mass Mail version 1.0 suffers from a remote shell upload vulnerability.

tags | exploit, remote, shell, php
MD5 | 0cb5d71edeb4a2b0e094423306caac00
The Powerful Resource Of PHP Stream Wrappers
Posted Nov 15, 2018
Authored by Netsparker

In this article, the author explores ways to bypass protection methods using the PHP Stream Wrappers, which are responsible for handling protocol related tasks like downloading data from a web or ftp server and exposing it in a way in that it can be handled with PHP's stream related functions.

tags | paper, web, php, protocol
MD5 | a947e8c1cb30f07e7cee7d234092661e
PHP 5.2.3 imap_open Bypass
Posted Nov 15, 2018
Authored by Anton Lopanitsyn

PHP version 5.2.3 (Debian) suffers from an imap imap_open disable functions bypass vulnerability.

tags | exploit, php, imap, bypass
systems | linux, debian
MD5 | aa9bfde85a72aab2622a5ce32e492d2a
D-LINK Central WifiManager (CWM 100) 1.03 r0098 Server-Side Request Forgery
Posted Nov 9, 2018
Authored by hyp3rlinx | Site hyp3rlinx.altervista.org

Using a web browser or script server-side request forgery (SSRF) can be initiated against internal/external systems to conduct port scans by leveraging D-LINK's MailConnect component. The MailConnect feature on D-Link Central WiFiManager CWM-100 version 1.03 r0098 devices is intended to check a connection to an SMTP server but actually allows outbound TCP to any port on any IP address, leading to SSRF, as demonstrated by an index.php/System/MailConnect/host/127.0.0.1/port/22/secure/ URI. This can undermine accountability of where scan or connections actually came from and or bypass the FW etc. This can be automated via script or using Web Browser.

tags | exploit, web, php, tcp
advisories | CVE-2018-15517
MD5 | d9afd3cea418548b6c3b72153c1261fe
blueimp jQuery Arbitrary File Upload
Posted Nov 5, 2018
Authored by Larry W. Cashdollar, wvu, Claudio Viviani | Site metasploit.com

This Metasploit module exploits an arbitrary file upload in the sample PHP upload handler for blueimp's jQuery File Upload widget in versions 9.22.0 and below. Due to a default configuration in Apache 2.3.9+, the widget's .htaccess file may be disabled, enabling exploitation of this vulnerability. This vulnerability has been exploited in the wild since at least 2015 and was publicly disclosed to the vendor in 2018. It has been present since the .htaccess change in Apache 2.3.9. This Metasploit module provides a generic exploit against the jQuery widget.

tags | exploit, arbitrary, php, file upload
advisories | CVE-2018-9206
MD5 | dc66674939d313842bacc7cddcbdd16c
PHP Proxy 3.0.3 Local File Inclusion
Posted Nov 5, 2018
Authored by Ozkan Mustafa Akkus

PHP Proxy version 3.0.3 suffers from a local file inclusion vulnerability.

tags | exploit, local, php, file inclusion
MD5 | 87c29784be880e65ee17bc44869c13be
Simple PHP Shopping Cart 0.9 Shell Upload / SQL Injection
Posted Oct 31, 2018
Authored by Ihsan Sencan

Simple PHP Shopping Cart version 0.9 suffers from remote shell upload and remote SQL injection vulnerabilities.

tags | exploit, remote, shell, php, vulnerability, sql injection
MD5 | 590960260c339d781b319ed9b86ae390
PHP-SHOP Master 1.0 Cross Site Request Forgery
Posted Oct 18, 2018
Authored by Alireza Norkazemi

PHP-SHOP Master version 1.0 suffers from a cross site request forgery vulnerability.

tags | exploit, php, csrf
MD5 | 8a78b5651bd99ac517bc63e491f64913
FLIR Systems FLIR AX8 Thermal Camera 1.32.16 Arbitrary File Disclosure
Posted Oct 15, 2018
Authored by LiquidWorm | Site zeroscience.mk

The FLIR AX8 thermal sensor camera version 1.32.16 suffers from an unauthenticated arbitrary file disclosure vulnerability. Input passed via the 'file' parameter in download.php is not properly verified before being used to download config files. This can be exploited to disclose the contents of arbitrary files via absolute path.

tags | exploit, arbitrary, php
MD5 | acdaa748301edd2bc81cd2080da980c7
Page 1 of 190
Back12345Next

File Archive:

January 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jan 1st
    15 Files
  • 2
    Jan 2nd
    15 Files
  • 3
    Jan 3rd
    11 Files
  • 4
    Jan 4th
    1 Files
  • 5
    Jan 5th
    2 Files
  • 6
    Jan 6th
    5 Files
  • 7
    Jan 7th
    24 Files
  • 8
    Jan 8th
    15 Files
  • 9
    Jan 9th
    16 Files
  • 10
    Jan 10th
    22 Files
  • 11
    Jan 11th
    17 Files
  • 12
    Jan 12th
    3 Files
  • 13
    Jan 13th
    2 Files
  • 14
    Jan 14th
    18 Files
  • 15
    Jan 15th
    30 Files
  • 16
    Jan 16th
    0 Files
  • 17
    Jan 17th
    0 Files
  • 18
    Jan 18th
    0 Files
  • 19
    Jan 19th
    0 Files
  • 20
    Jan 20th
    0 Files
  • 21
    Jan 21st
    0 Files
  • 22
    Jan 22nd
    0 Files
  • 23
    Jan 23rd
    0 Files
  • 24
    Jan 24th
    0 Files
  • 25
    Jan 25th
    0 Files
  • 26
    Jan 26th
    0 Files
  • 27
    Jan 27th
    0 Files
  • 28
    Jan 28th
    0 Files
  • 29
    Jan 29th
    0 Files
  • 30
    Jan 30th
    0 Files
  • 31
    Jan 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close