CVE-2007-1286
PHP < 4.4.4 - Remote Code Execution via Long String to unserialize Function
Title source: manualExploitation Summary
EIP tracks 4 public exploits for CVE-2007-1286.
PoCs published by Metasploit, Stefan Esser, sesser, including Metasploit module exploits/multi/php/php_unserialize_zval_cookie.
AI-analyzed exploit summary This Metasploit module exploits an integer overflow vulnerability in PHP 4's unserialize() function via a maliciously crafted cookie. It targets multiple web applications and uses brute-forcing to achieve remote code execution on Linux x86 systems.
Description
Integer overflow in PHP 4.4.4 and earlier allows remote context-dependent attackers to execute arbitrary code via a long string to the unserialize function, which triggers the overflow in the ZVAL reference counter.
Exploits (4)
This Metasploit module exploits an integer overflow vulnerability in PHP 4's unserialize() function via a maliciously crafted cookie. It targets multiple web applications and uses brute-forcing to achieve remote code execution on Linux x86 systems.
This exploit targets a reference counter overflow in PHP 4's unserialize() function, leading to arbitrary memory corruption. It constructs a malicious serialized string to trigger the vulnerability, causing a crash or potential code execution.
This Metasploit module exploits an integer overflow in PHP 4's unserialize() function via a maliciously crafted cookie. It targets multiple web applications and uses brute-forcing to achieve remote code execution on Linux x86 systems.
This Metasploit module exploits an integer overflow vulnerability in PHP 4's unserialize() function via a maliciously crafted cookie. It targets multiple web applications and uses brute-forcing to achieve remote code execution on Linux x86 systems.