CVE-2006-4812
PHP 4 < 4.3.0 and 5 <= 5.1.6 - Remote Code Execution via Unserialize Integer Overflow
Title source: manualExploitation Summary
EIP tracks 1 public exploit for CVE-2006-4812. PoCs published by anonymous.
AI-analyzed exploit summary This exploit demonstrates an integer overflow vulnerability in PHP's unserialize function, leading to a heap overflow in zend_hash_init(). The PoC triggers a segmentation fault and discusses potential exploitation via zend_hash_del_index_or_key.
Description
Integer overflow in PHP 5 up to 5.1.6 and 4 before 4.3.0 allows remote attackers to execute arbitrary code via an argument to the unserialize PHP function with a large value for the number of array elements, which triggers the overflow in the Zend Engine ecalloc function (Zend/zend_alloc.c).
Exploits (1)
This exploit demonstrates an integer overflow vulnerability in PHP's unserialize function, leading to a heap overflow in zend_hash_init(). The PoC triggers a segmentation fault and discusses potential exploitation via zend_hash_del_index_or_key.