PHP - MultiPart Form-Data Denial of Service (PoC)

ExploitDBExploitDB exploitExploitEDB-10243

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

ExploitDB
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python script that sends repeated HTTP POST requests with multipart/form-data containing a large number of file fields (default 15000) to a target PHP server, aiming to cause a denial of service.

Backdoor review

No backdoor observed in reviewed code

The PoC is a straightforward PHP multipart form-data denial-of-service script. It sends many HTTP POST requests with a large number of file parts to exhaust server resources. The default file content is a PHP webshell string, but this is clearly documented as the default data payload for the DoS attack and is user-configurable. No hidden, deceptive, or unrelated backdoor behavior is present.

ClassificationExploit
Model confidence95%
AuthenticationNot required
Languagespython
Target softwarePHP
Attack typesdenial of service
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively sends crafted HTTP requests designed to exhaust server resources (infinite loop, many file fields), which constitutes an exploit for a denial-of-service vulnerability. It does not merely check for the vulnerability.

exploits/php/dos/10243.py:3exploits/php/dos/10243.py:34-39exploits/php/dos/10243.py:50

Requirements

  • Target URL must accept POST requests with multipart/form-data.exploits/php/dos/10243.py:50

Observed behavior

  • Parses command-line arguments for target URL, number of threads (default 10), number of files (default 15000), and file data content.exploits/php/dos/10243.py:75-94
  • Constructs a list of multipart file fields with key 'fu[]', sequential filenames, and attacker-controlled data (default PHP code).exploits/php/dos/10243.py:102-105
  • Spawns multiple threads that each continuously send the crafted multipart POST request to the target in an infinite loop.exploits/php/dos/10243.py:34-39exploits/php/dos/10243.py:107-109
  • Encodes the multipart/form-data body with a static boundary string and sends it via HTTPConnection.request.exploits/php/dos/10243.py:42-73
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Default Payload
<?php eval($_REQUEST[x]); ?>The default data string used as file content in the multipart POST requests. This is a well-known PHP webshell, but its use here is explicitly described in the usage function (line 20) and is part of the advertised DoS mechanism. The user can override it via command-line argument (lines 91-92).exploits/php/dos/10243.py:20exploits/php/dos/10243.py:83exploits/php/dos/10243.py:91-92
Review boundaries

What the analysis did not establish

  • Evidence is limited to the single Python script; no external libraries, target environment, or execution results are included.
  • The script's default data field contains PHP code, but the primary operation is sending many file fields in a loop to cause denial of service, not executing that code.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

0

This PoC is retained in the catalog but is not currently linked to a vulnerability.