CVE-2007-0911

PHP 5.2.1 - Denial of Service via Off-by-One Error in str_ireplace

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2007-0911. PoCs published by Thomas Hruska.

AI-analyzed exploit summary This exploit demonstrates a denial-of-service vulnerability in PHP 5.2.1 by repeatedly replacing newline characters in a string, causing excessive resource consumption and potential crashes. The PoC leverages the `str_ireplace` function to trigger the issue.

Description

Off-by-one error in the str_ireplace function in PHP 5.2.1 might allow context-dependent attackers to cause a denial of service (crash).

Exploits (1)

exploitdb WORKING POC VERIFIED

by Thomas Hruska · phpdosphp

https://www.exploit-db.com/exploits/29577

View Code ZIP pw:eip

This exploit demonstrates a denial-of-service vulnerability in PHP 5.2.1 by repeatedly replacing newline characters in a string, causing excessive resource consumption and potential crashes. The PoC leverages the `str_ireplace` function to trigger the issue.

Classification

Working Poc 90%

Attack Type

Dos

Complexity

Trivial

Reliability

Reliable

Target: PHP 5.2.1

No auth needed

Prerequisites: Ability to execute PHP code on the target system

MITRE ATT&CK