CVE-2018-17057

CRITICAL

TCPDF < 6.2.22 - Remote Code Execution via PHAR Deserialization

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2018-17057. PoCs published by q3rv0.

AI-analyzed exploit summary This exploit leverages a deserialization vulnerability in LimeSurvey < 3.16 via the TCPDF library's use of the 'phar://' wrapper to achieve remote code execution. It authenticates, uploads a malicious PHAR file, and triggers deserialization through a PDF export function.

Description

An issue was discovered in TCPDF before 6.2.22. Attackers can trigger deserialization of arbitrary data via the phar:// wrapper.

Exploits (1)

exploitdb WORKING POC

by q3rv0 · pythonwebappsphp

https://www.exploit-db.com/exploits/46634

View Code ZIP pw:eip

This exploit leverages a deserialization vulnerability in LimeSurvey < 3.16 via the TCPDF library's use of the 'phar://' wrapper to achieve remote code execution. It authenticates, uploads a malicious PHAR file, and triggers deserialization through a PDF export function.

Classification

Working Poc 95%

Attack Type

Rce

Complexity

Moderate

Reliability

Reliable

Target: LimeSurvey < 3.16

Auth required

Prerequisites: Valid credentials for LimeSurvey · Network access to the target · PHP environment with PHAR support

MITRE ATT&CK