CVE-2008-5498
PHP < 5.2.8 - Exposure of Sensitive Information via imageRotate Function
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2008-5498. PoCs published by Hamid Ebadi.
AI-analyzed exploit summary This exploit leverages an information leak vulnerability in PHP's gd library (CVE-2008-5498) by manipulating the `imageRotate()` function's `clrBack` parameter to read arbitrary memory addresses. The PoC demonstrates how to extract memory values by rotating an image and decoding the resulting color data.
Description
Array index error in the imageRotate function in PHP 5.2.8 and earlier allows context-dependent attackers to read the contents of arbitrary memory locations via a crafted value of the third argument (aka the bgd_color or clrBack argument) for an indexed image.
Exploits (1)
This exploit leverages an information leak vulnerability in PHP's gd library (CVE-2008-5498) by manipulating the `imageRotate()` function's `clrBack` parameter to read arbitrary memory addresses. The PoC demonstrates how to extract memory values by rotating an image and decoding the resulting color data.