CVE-2000-0967
PHP 3 and 4 - Remote Code Execution via Format String Injection
Title source: manualExploitation Summary
EIP tracks 2 public exploits for CVE-2000-0967. PoCs published by Gneisenau, anonymous.
AI-analyzed exploit summary This exploit targets a remote format string vulnerability in PHP 3.0.16/4.0.2 by crafting a malicious HTTP POST request with embedded shellcode. It leverages a buffer overflow to overwrite the EIP and execute arbitrary code, specifically spawning a shell via inetd.
Description
PHP 3 and 4 do not properly cleanse user-injected format strings, which allows remote attackers to execute arbitrary commands by triggering error messages that are improperly written to the error logs.
Exploits (2)
This exploit targets a remote format string vulnerability in PHP 3.0.16/4.0.2 by crafting a malicious HTTP POST request with embedded shellcode. It leverages a buffer overflow to overwrite the EIP and execute arbitrary code, specifically spawning a shell via inetd.
This exploit targets a format string vulnerability in PHP versions below 4.0.3, leveraging error logging to execute arbitrary code via crafted format specifiers. The PoC constructs a malicious HTTP POST request with shellcode to achieve remote code execution.