EIP-2026-104699
PRE-CVEPHP 4.x/5.0 Shared Memory Module - Offset Memory Corruption
Title source: legacyExploitation Summary
EIP tracks 1 public exploit for EIP-2026-104699. PoCs published by Stefano Di Paola.
AI-analyzed exploit summary This PoC exploits an integer handling vulnerability in the PHP shmop module to perform an arbitrary write into process memory, specifically targeting the safe_mode global variable to bypass PHP's safe mode restrictions. The exploit uses shmop_write with a crafted offset to overwrite the safe_mode value, demonstrating privilege escalation in a shared-server environment.
Description
PHP 4.x/5.0 Shared Memory Module - Offset Memory Corruption
Exploits (1)
This PoC exploits an integer handling vulnerability in the PHP shmop module to perform an arbitrary write into process memory, specifically targeting the safe_mode global variable to bypass PHP's safe mode restrictions. The exploit uses shmop_write with a crafted offset to overwrite the safe_mode value, demonstrating privilege escalation in a shared-server environment.