Exploitation Summary
EIP tracks 2 public exploits for CVE-2022-31630. PoCs published by sepkascurty-cpu.
AI-analyzed exploit summary This repository contains a functional Proof of Concept (PoC) exploit for CVE-2022-31630, an Out-of-Bounds (OOB) Read vulnerability in PHP's GD extension. The exploit demonstrates the vulnerability by creating a malformed font file that triggers an OOB read when processed by the imageloadfont() function.
Description
In PHP versions prior to 7.4.33, 8.0.25 and 8.1.12, when using imageloadfont() function in gd extension, it is possible to supply a specially crafted font file, such as if the loaded font is used with imagechar() function, the read outside allocated buffer will be used. This can lead to crashes or disclosure of confidential information.
Exploits (2)
This repository contains a functional Proof of Concept (PoC) exploit for CVE-2022-31630, an Out-of-Bounds (OOB) Read vulnerability in PHP's GD extension. The exploit demonstrates the vulnerability by creating a malformed font file that triggers an OOB read when processed by the imageloadfont() function.
This repository provides a detailed technical analysis of CVE-2022-31630, an Out-of-Bounds (OOB) Read vulnerability in PHP's GD extension, specifically in the imageloadfont() function. It explains the root cause, affected versions, and the mechanism of exploitation but does not include functional exploit code.
References (1)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L