CVE-2012-0830
PHP 5.3.9 - Remote Code Execution via Large Number of Variables
Title source: manualExploitation Summary
EIP tracks 1 public exploit for CVE-2012-0830. PoCs published by Stefan Esser.
AI-analyzed exploit summary This exploit targets a memory corruption vulnerability in PHP 5.4.0RC6 (64-bit) by crafting a malicious multipart/form-data POST request. It attempts to execute arbitrary code at a controlled memory address (0x1111111111111111) by manipulating Hashtable structures, bypassing ASLR through brute-force attempts.
Description
The php_register_variable_ex function in php_variables.c in PHP 5.3.9 allows remote attackers to execute arbitrary code via a request containing a large number of variables, related to improper handling of array variables. NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-4885.
Exploits (1)
This exploit targets a memory corruption vulnerability in PHP 5.4.0RC6 (64-bit) by crafting a malicious multipart/form-data POST request. It attempts to execute arbitrary code at a controlled memory address (0x1111111111111111) by manipulating Hashtable structures, bypassing ASLR through brute-force attempts.