CVE-2011-5035
Oracle Glassfish < 3.1.1 - Denial of Service via Predictable Hash Collisions
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2011-5035.
PoCs published by rgod, Alexander Klink, Julian Waelde, Scott A. Crosby, Dan S. Wallach, Krzysztof Kotowicz, Christian Mehlmauer, including Metasploit module auxiliary/dos/http/hashcollision_dos.
AI-analyzed exploit summary This exploit demonstrates a SQL injection vulnerability in MyBulletinBoard (MyBB) <= 1.1.5 via the CLIENT-IP HTTP header, allowing an attacker to retrieve the admin login key and create a new admin user.
Description
Oracle Glassfish 2.1.1, 3.0.1, and 3.1.1, as used in Communications Server 2.0, Sun Java System Application Server 8.1 and 8.2, and possibly other products, computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters, aka Oracle security ticket S0104869.
Exploits (2)
This exploit demonstrates a SQL injection vulnerability in MyBulletinBoard (MyBB) <= 1.1.5 via the CLIENT-IP HTTP header, allowing an attacker to retrieve the admin login key and create a new admin user.
This Metasploit module exploits a hash collision vulnerability in PHP and Java web servers by generating a large number of POST parameters with colliding hash values, causing excessive CPU consumption and a denial-of-service condition.