Exploitation Summary
CVE-2012-2688 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 2 public exploits from researchers including shelld3v.
AI-analyzed exploit summary This Python script exploits CVE-2012-2688, a remote code execution vulnerability in PHP's query string parameter handling. It leverages PHP's allow_url_include and auto_prepend_file directives to execute arbitrary commands via a crafted POST request.
Description
Unspecified vulnerability in the _php_stream_scandir function in the stream implementation in PHP before 5.3.15 and 5.4.x before 5.4.5 has unknown impact and remote attack vectors, related to an "overflow."
Exploits (2)
This Python script exploits CVE-2012-2688, a remote code execution vulnerability in PHP's query string parameter handling. It leverages PHP's allow_url_include and auto_prepend_file directives to execute arbitrary commands via a crafted POST request.
This repository contains a functional Python exploit for CVE-2017-18345, targeting an arbitrary file download vulnerability in the Joomanager component for Joomla. The script automates the exploitation process by sending crafted HTTP requests to download sensitive files like configuration.php.