CVE-2011-5034
Apache Geronimo < 2.2.1 - Denial of Service via Predictable Hash Collisions
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2011-5034.
PoCs published by Alexander Klink, Julian Waelde, Scott A. Crosby, Dan S. Wallach, Krzysztof Kotowicz, Christian Mehlmauer, including Metasploit module auxiliary/dos/http/hashcollision_dos.
AI-analyzed exploit summary This Metasploit module exploits a denial-of-service vulnerability in PHP and Java by generating a large number of colliding hash values in POST parameters, causing excessive CPU consumption. It includes payload generation for both PHP and Java hash functions and sends multiple HTTP requests to the target.
Description
Apache Geronimo 2.2.1 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters. NOTE: this might overlap CVE-2011-4461.
Exploits (2)
This Metasploit module exploits a denial-of-service vulnerability in PHP and Java by generating a large number of colliding hash values in POST parameters, causing excessive CPU consumption. It includes payload generation for both PHP and Java hash functions and sends multiple HTTP requests to the target.
This exploit demonstrates a SQL injection vulnerability in MyBulletinBoard (MyBB) <= 1.1.5 via the CLIENT-IP HTTP header, allowing an attacker to retrieve the admin login key and create a new admin user. The exploit uses blind SQL injection to extract the login key and then crafts an admin cookie to add a new admin user.