CVE-2023-3824
CRITICAL EXPLOITED RANSOMWAREPHP <8.0.30-8.2.8 - Buffer Overflow
Title source: llmExploitation Summary
CVE-2023-3824 has been observed exploited in the wild (reported by VulnCheck KEV), including in ransomware campaigns. EIP tracks 3 public exploits from researchers including jhonnybonny, dadosneurais, bluefish3r.
AI-analyzed exploit summary This repository provides a functional PoC for CVE-2023-3824, demonstrating a buffer overflow vulnerability in PHP's Phar file handling. It includes code to create a malicious Phar file and trigger the overflow via directory operations.
Description
In PHP version 8.0.* before 8.0.30, 8.1.* before 8.1.22, and 8.2.* before 8.2.8, when loading phar file, while reading PHAR directory entries, insufficient length checking may lead to a stack buffer overflow, leading potentially to memory corruption or RCE.
Exploits (3)
This repository provides a functional PoC for CVE-2023-3824, demonstrating a buffer overflow vulnerability in PHP's Phar file handling. It includes code to create a malicious Phar file and trigger the overflow via directory operations.
This repository contains a functional exploit for CVE-2023-3824, leveraging PHAR deserialization to achieve remote code execution (RCE). The exploit involves uploading a malicious PHAR file, which extracts a shell.php payload to execute arbitrary commands.
The repository contains only a README with a link to an external Codeberg repository, providing no technical details or exploit code. This is characteristic of a social engineering lure.
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L