Exploit the possiblities
Showing 1 - 25 of 4,626 RSS Feed

PHP Files

Gentoo Linux Security Advisory 201711-15
Posted Nov 20, 2017
Authored by Gentoo | Site security.gentoo.org

Gentoo Linux Security Advisory 201711-15 - A vulnerability was discovered in PHPUnit which may allow an unauthenticated remote attacker to execute arbitrary PHP code. Versions less than 5.7.15-r1 are affected.

tags | advisory, remote, arbitrary, php
systems | linux, gentoo
advisories | CVE-2017-9841
MD5 | 3efd28186a638dcc6acc88c4c14ce3c5
Red Hat Security Advisory 2017-3221-01
Posted Nov 15, 2017
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2017-3221-01 - PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fix: A null pointer dereference flaw was found in libgd. An attacker could use a specially-crafted .gd2 file to cause an application linked with libgd to crash, leading to denial of service. An integer overflow flaw, leading to a heap-based buffer overflow was found in the way libgd read some specially-crafted gd2 files. A remote attacker could use this flaw to crash an application compiled with libgd or in certain cases execute arbitrary code with the privileges of the user running that application.

tags | advisory, remote, web, denial of service, overflow, arbitrary, php
systems | linux, redhat
advisories | CVE-2016-10167, CVE-2016-10168
MD5 | 2650f0d1afa1fd9360d227fd6867d136
WordPress WP Mobile Detector 3.5 Shell Upload
Posted Nov 3, 2017
Authored by h00die, Aaditya Purani | Site metasploit.com

WP Mobile Detector Plugin for WordPress contains a flaw that allows a remote attacker to execute arbitrary PHP code. This flaw exists because the /wp-content/plugins/wp-mobile-detector/resize.php script does contains a remote file include for files not cached by the system already. By uploading a .php file, the remote system will place the file in a user-accessible path. Making a direct request to the uploaded file will allow the attacker to execute the script with the privileges of the web server.

tags | exploit, remote, web, arbitrary, php
MD5 | 1d01dc001a0e9ab61957d22e50f28f0c
AROX School ERP PHP Script SQL Injection
Posted Nov 2, 2017
Authored by Ihsan Sencan

AROX School ERP PHP Script suffers from a remote SQL injection vulnerability.

tags | exploit, remote, php, sql injection
advisories | CVE-2017-15978
MD5 | 358add815952626c233d8974647c8a64
Nice PHP FAQ Script SQL Injection
Posted Nov 2, 2017
Authored by Ihsan Sencan

Nice PHP FAQ Script suffers from a remote SQL injection vulnerability.

tags | exploit, remote, php, sql injection
advisories | CVE-2017-15988
MD5 | b4185cf54601d59702e05dc954376f11
PHP Inventory Arbitrary File Upload
Posted Oct 30, 2017
Authored by Ihsan Sencan

PHP Inventory suffers from an arbitrary file upload vulnerability.

tags | exploit, arbitrary, php, file upload
advisories | CVE-2017-15990
MD5 | f0ea39e29684cdfddf40e9ddbea32ec3
WordPress Ultimate Product Catalog 4.2.24 PHP Object Injection
Posted Oct 30, 2017
Authored by tomplixsee

WordPress Ultimate Product Catalog plugin versions 4.2.24 and below suffer from a PHP object injection vulnerability.

tags | exploit, php
MD5 | 3f4ffd5d0fa22e90026bf5db1d8f6c0b
PHP 4.2.0 / 4.2.1 Remote Compromise / Denial Of Service
Posted Oct 27, 2017
Authored by Stefan Esser

PHP versions 4.2.0 and 4.2.1 suffer from an issue where depending on the processor architecture it may be possible for a remote attacker to either crash or compromise the web server.

tags | advisory, remote, web, denial of service, php
MD5 | e966da86f2a1eebadb8468cec478394a
PHP Melody 2.6.1 SQL Injection
Posted Oct 25, 2017
Authored by Venkat Rajgor

PHP Melody version 2.6.1 suffers from a remote SQL injection vulnerability.

tags | exploit, remote, php, sql injection
MD5 | d1030b2d22474e4e4a43dd856b933af5
Tuleap 9.6 Second-Order PHP Object Injection
Posted Oct 24, 2017
Authored by EgiX | Site karmainsecurity.com

Tuleap versions 9.6 and below suffer from a second order PHP object injection vulnerability.

tags | advisory, php
advisories | CVE-2017-7411
MD5 | 2a4b257f70f6f54a3226a84d41b3ca08
PHP Melody 2.7.3 Cross Site Scripting / SQL Injection
Posted Oct 12, 2017
Authored by Paulos Yibelo

PHP Melody version 2.7.3 suffers from cross site scripting and SQL injection vulnerabilities.

tags | exploit, php, vulnerability, xss, sql injection
MD5 | 8d8544bc3a6ba55df5cbb4bfaefe5794
Trend Micro InterScan Messaging Security (Virtual Appliance) Remote Code Execution
Posted Oct 12, 2017
Authored by mr_me, Mehmet Ince | Site metasploit.com

This Metasploit module exploits the authentication bypass and command injection vulnerability together. Unauthenticated users can execute a terminal command under the context of the web server user. The specific flaw exists within the management interface, which listens on TCP port 443 by default. Trend Micro IMSVA product have widget feature which is implemented with PHP. Insecurely configured web server exposes diagnostic.log file, which leads to an extraction of JSESSIONID value from administrator session. Proxy.php files under the mod TMCSS folder takes multiple parameter but the process does not properly validate a user-supplied string before using it to execute a system call. Due to combination of these vulnerabilities, unauthenticated users can execute a terminal command under the context of the web server user.

tags | exploit, web, php, tcp, vulnerability
MD5 | c596a4696eab69db88b173ffa1c4b5fb
X-Cart 5.2.23 / 5.3.1.9 / 5.3.2.13 / 5.3.3 PHP Code Injection
Posted Oct 12, 2017
Authored by sxcurity

X-Cart versions 5.2.23, 5.3.1.9, 5.3.2.13, and 5.3.3 suffer from a PHP code injection vulnerability.

tags | exploit, php
MD5 | 517d89663c7dc4f461e8a51d590a30bf
Trend Micro OfficeScan Remote Code Execution
Posted Oct 10, 2017
Authored by mr_me, Mehmet Ince | Site metasploit.com

This Metasploit module exploits the authentication bypass and command injection vulnerability together. Unauthenticated users can execute a terminal command under the context of the web server user. The specific flaw exists within the management interface, which listens on TCP port 443 by default. The Trend Micro Officescan product has a widget feature which is implemented with PHP. Talker.php takes ack and hash parameters but doesn't validate these values, which leads to an authentication bypass for the widget. Proxy.php files under the mod TMCSS folder take multiple parameters but the process does not properly validate a user-supplied string before using it to execute a system call. Due to combination of these vulnerabilities, unauthenticated users can execute a terminal command under the context of the web server user.

tags | exploit, web, php, tcp, vulnerability
MD5 | 02f022c47acfeb55ae34578721c1b3be
PHP Multi Vendor Script 1.02 SQL Injection
Posted Oct 1, 2017
Authored by 8bitsec

PHP Multi Vendor Script version 1.02 suffers from a remote SQL injection vulnerability.

tags | exploit, remote, php, sql injection
MD5 | 3e127f8c407e6c4653405c02e469d49c
PHP CityPortal 2.0 SQL Injection
Posted Sep 29, 2017
Authored by Ihsan Sencan

PHP CityPortal version 2.0 suffers from a remote SQL injection vulnerability.

tags | exploit, remote, php, sql injection
MD5 | ab34a7a0ef59aefc13293ec209d12e32
Easy Blog PHP Script 1.3a SQL Injection
Posted Sep 29, 2017
Authored by 8bitsec

Easy Blog PHP Script version 1.3a suffers from a remote SQL injection vulnerability.

tags | exploit, remote, php, sql injection
MD5 | fa89f896f402771ab795844cdedf5a00
TrendMicro OfficeScan 11.0 / XG (12.0) Information Disclosure
Posted Sep 29, 2017
Authored by hyp3rlinx | Site hyp3rlinx.altervista.org

TrendMicro OfficeScan versions 11.0 and XG (12.0) suffer from NT domain and PHP information disclosure vulnerabilities.

tags | exploit, php, vulnerability, info disclosure
advisories | CVE-2017-14085
MD5 | 8849cad3ac8077aaabee386cf3a4f609
FLIR Systems FLIR Thermal Camera PT-Series (PT-334 200562) Remote Root
Posted Sep 25, 2017
Authored by LiquidWorm | Site zeroscience.mk

FLIR Camera PT-Series suffers from multiple unauthenticated remote command injection vulnerabilities. The vulnerability exist due to several POST parameters in controllerFlirSystem.php script when calling the execFlirSystem() function not being sanitized when using the shell_exec() PHP function while updating the network settings on the affected device. This allows the attacker to execute arbitrary system commands as the root user and bypass access controls in place.

tags | exploit, remote, arbitrary, root, php, vulnerability
MD5 | 5ddf109d3a422df75105565034f680b0
Gentoo Linux Security Advisory 201709-21
Posted Sep 25, 2017
Authored by Gentoo | Site security.gentoo.org

Gentoo Linux Security Advisory 201709-21 - Multiple vulnerabilities have been found in PHP, the worst of which could result in the execution of arbitrary code. Versions less than 5.6.31:5.6 are affected.

tags | advisory, arbitrary, php, vulnerability
systems | linux, gentoo
advisories | CVE-2017-11362, CVE-2017-11628, CVE-2017-12932
MD5 | e37ef91858dce51d5410cc67c898748f
PHP Auction Ecommerce Script 1.6 SQL Injection
Posted Sep 22, 2017
Authored by 8bitsec

PHP Auction Ecommerce Script version 1.6 suffers from a remote SQL injection vulnerability.

tags | exploit, remote, php, sql injection
MD5 | 1bbb761c85a0eeb2c41619563fcc7584
Carlo Gavazzi Powersoft 2.1.1.1 Directory Traversal
Posted Sep 15, 2017
Authored by James Fitts | Site metasploit.com

This Metasploit module exploits a directory traversal vulnerability found in Carlo Gavazzi Powersoft versions 2.1.1.1 and below. The vulnerability is triggered when sending a specially crafted GET request to the server. The location parameter of the GET request is not sanitized and the sendCommand.php script will automatically pull down any file requested

tags | exploit, php, file inclusion
MD5 | 7ead626f719b2712cc6f6e65a79e2c9f
PHP Dashboards NEW 4.4 SQL Injection
Posted Sep 12, 2017
Authored by Ihsan Sencan

PHP Dashboards NEW version 4.4 suffers from a remote SQL injection vulnerability.

tags | exploit, remote, php, sql injection
MD5 | db1a533b5870ca5c881efd5b9d56039e
PHP Dashboards NEW 4.4 Arbitrary File Read
Posted Sep 12, 2017
Authored by Ihsan Sencan

PHP Dashboards NEW version 4.4 suffers from an arbitrary file read vulnerability.

tags | exploit, arbitrary, php
MD5 | 62b7d50497d65bc8022a41ef2f61bdac
jRank Topsites 1.0 Cross Site Request Forgery / Code Injection
Posted Sep 9, 2017
Authored by Ihsan Sencan

jRank Topsites version 1.0 suffers from a cross site request forgery vulnerability that allows for PHP code injection vulnerability.

tags | exploit, php, csrf
MD5 | f9c9dacf3c805760fedafa777dff54be
Page 1 of 186
Back12345Next

File Archive:

November 2017

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Nov 1st
    22 Files
  • 2
    Nov 2nd
    28 Files
  • 3
    Nov 3rd
    10 Files
  • 4
    Nov 4th
    1 Files
  • 5
    Nov 5th
    5 Files
  • 6
    Nov 6th
    15 Files
  • 7
    Nov 7th
    15 Files
  • 8
    Nov 8th
    13 Files
  • 9
    Nov 9th
    9 Files
  • 10
    Nov 10th
    9 Files
  • 11
    Nov 11th
    3 Files
  • 12
    Nov 12th
    2 Files
  • 13
    Nov 13th
    15 Files
  • 14
    Nov 14th
    17 Files
  • 15
    Nov 15th
    19 Files
  • 16
    Nov 16th
    15 Files
  • 17
    Nov 17th
    19 Files
  • 18
    Nov 18th
    4 Files
  • 19
    Nov 19th
    2 Files
  • 20
    Nov 20th
    9 Files
  • 21
    Nov 21st
    15 Files
  • 22
    Nov 22nd
    23 Files
  • 23
    Nov 23rd
    0 Files
  • 24
    Nov 24th
    0 Files
  • 25
    Nov 25th
    0 Files
  • 26
    Nov 26th
    0 Files
  • 27
    Nov 27th
    0 Files
  • 28
    Nov 28th
    0 Files
  • 29
    Nov 29th
    0 Files
  • 30
    Nov 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2016 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close