Entreprise française de cybersécurité depuis 2004
☎ 03 60 47 09 81 - info@securiteinfo.com

CVE-2016-7124

Description

ext/standard/var_unserializer.c in PHP before 5.6.25 and 7.x before 7.0.10 mishandles certain invalid objects, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted serialized data that leads to a (1) __destruct call or (2) magic method call.

POC

Reference

- https://bugs.php.net/bug.php?id=72663

- https://www.tenable.com/security/tns-2016-19

Github

- https://github.com/ARPSyndicate/cvemon

- https://github.com/Fa1c0n35/Web-CTF-Cheatshee

- https://github.com/ProbiusOfficial/PHPSerialize-labs

- https://github.com/ProbiusOfficial/php-SER-labs-docker

- https://github.com/ZnnnnnH2/php-SER-libs-by-fine-1

- https://github.com/Zxser/Web-CTF-Cheatsheet

- https://github.com/duckstroms/Web-CTF-Cheatsheet

- https://github.com/fine-1/php-SER-libs

- https://github.com/jwt-123/unserialize-lab

- https://github.com/lnick2023/nicenice

- https://github.com/mengdaya/Web-CTF-Cheatsheet

- https://github.com/mrhenrike/Hacking-Cheatsheet

- https://github.com/nixawk/labs

- https://github.com/oneplus-x/MS17-010

- https://github.com/pwnosec/CTF-Cheatsheet

- https://github.com/qazbnm456/awesome-cve-poc

- https://github.com/todo1024/2041

- https://github.com/todo1024/2102

- https://github.com/w181496/Web-CTF-Cheatsheet

- https://github.com/wi1shu7/day_day_up

- https://github.com/xbl3/awesome-cve-poc_qazbnm456