Bogdan Calin
Source-scoped identity with 7 associated PoCs and 5 linked vulnerabilities.
Exploit catalog results
Showing 7 PoCs on this page
ExploitDBAxigen Webmail 1.0.1 - Directory Traversal
ExploitDB exploitPublished 2010-09-15Not analyzedCVE-2010-34601 file
ExploitDBZenPhoto 1.3 - '/zp-core/full-image.php?a' SQL Injection
ExploitDB exploitPublished 2010-09-07Not analyzedCVE-2010-49061 file
ExploitDBZenPhoto 1.3 - '/zp-core/admin.php' Multiple Cross-Site Scripting Vulnerabilities
ExploitDB exploitPublished 2010-09-07Not analyzedCVE-2010-49071 file
ExploitDBNuSOAP 0.9.5 - 'nusoap.php' Cross-Site Scripting
ExploitDB exploitPublished 2010-09-03Not analyzedCVE-2010-30701 file
ExploitDBPligg CMS 1.0.4 - SQL Injection / Cross-Site Scripting
ExploitDB exploitPublished 2010-09-03Not analyzedUnlinked1 file
ExploitDBPHP - MultiPart Form-Data Denial of Service (PoC)
ExploitDB exploitPublished 2009-11-22ExploitUnlinked1 file
Analysis
Technical assessment
Python script that sends repeated HTTP POST requests with multipart/form-data containing a large number of file fields (default 15000) to a target PHP server, aiming to cause a denial of service.
Backdoor review
No backdoor observed in reviewed code
The PoC is a straightforward PHP multipart form-data denial-of-service script. It sends many HTTP POST requests with a large number of file parts to exhaust server resources. The default file content is a PHP webshell string, but this is clearly documented as the default data payload for the DoS attack and is user-configurable. No hidden, deceptive, or unrelated backdoor behavior is present.
Classification basis and observed behavior
Classification basis
The script actively sends crafted HTTP requests designed to exhaust server resources (infinite loop, many file fields), which constitutes an exploit for a denial-of-service vulnerability. It does not merely check for the vulnerability.
exploits/php/dos/10243.py:3exploits/php/dos/10243.py:34-39exploits/php/dos/10243.py:50Requirements
- Target URL must accept POST requests with multipart/form-data.
exploits/php/dos/10243.py:50
Observed behavior
- Parses command-line arguments for target URL, number of threads (default 10), number of files (default 15000), and file data content.
exploits/php/dos/10243.py:75-94 - Constructs a list of multipart file fields with key 'fu[]', sequential filenames, and attacker-controlled data (default PHP code).
exploits/php/dos/10243.py:102-105 - Spawns multiple threads that each continuously send the crafted multipart POST request to the target in an infinite loop.
exploits/php/dos/10243.py:34-39exploits/php/dos/10243.py:107-109 - Encodes the multipart/form-data body with a static boundary string and sends it via HTTPConnection.request.
exploits/php/dos/10243.py:42-73
Behaviors behind the backdoor verdict
Observables
- Default Payload
- Payload withheldThe default data string used as file content in the multipart POST requests. This is a well-known PHP webshell, but its use here is explicitly described in the usage function (line 20) and is part of the advertised DoS mechanism. The user can override it via command-line argument (lines 91-92).
exploits/php/dos/10243.py:20exploits/php/dos/10243.py:83exploits/php/dos/10243.py:91-92
What the analysis did not establish
- Evidence is limited to the single Python script; no external libraries, target environment, or execution results are included.
- The script's default data field contains PHP code, but the primary operation is sending many file fields in a loop to cause denial of service, not executing that code.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.