CVE-2011-4858
Apache Tomcat < 5.5.35, 6.x < 6.0.35, 7.x < 7.0.23 - Denial of Service via Hash Collision in Form Parameters
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2011-4858.
PoCs published by Alexander Klink, Julian Waelde, Scott A. Crosby, Dan S. Wallach, Krzysztof Kotowicz, Christian Mehlmauer, including Metasploit module auxiliary/dos/http/hashcollision_dos.
AI-analyzed exploit summary This Metasploit module exploits a denial-of-service (DoS) vulnerability in PHP and Java web servers by generating a large number of colliding hash values in POST parameters, causing excessive CPU consumption. It includes payload generation for both PHP and Java hash functions and sends multiple HTTP requests to the target.
Description
Apache Tomcat before 5.5.35, 6.x before 6.0.35, and 7.x before 7.0.23 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.
Exploits (2)
This Metasploit module exploits a denial-of-service (DoS) vulnerability in PHP and Java web servers by generating a large number of colliding hash values in POST parameters, causing excessive CPU consumption. It includes payload generation for both PHP and Java hash functions and sends multiple HTTP requests to the target.
This exploit demonstrates a SQL injection vulnerability in MyBulletinBoard (MyBB) <= 1.1.5 via the 'CLIENT-IP' HTTP header. It retrieves the admin's login key through blind SQL injection and creates a new admin user by leveraging the stolen session.