cve/2016/CVE-2016-7124.md

### [CVE-2016-7124](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7124)
![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brighgreen)

### Description

ext/standard/var_unserializer.c in PHP before 5.6.25 and 7.x before 7.0.10 mishandles certain invalid objects, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted serialized data that leads to a (1) __destruct call or (2) magic method call.

### POC

#### Reference
- https://bugs.php.net/bug.php?id=72663
- https://www.tenable.com/security/tns-2016-19

#### Github
- https://github.com/ARPSyndicate/cvemon
- https://github.com/Fa1c0n35/Web-CTF-Cheatshee
- https://github.com/ProbiusOfficial/PHPSerialize-labs
- https://github.com/Zxser/Web-CTF-Cheatsheet
- https://github.com/duckstroms/Web-CTF-Cheatsheet
- https://github.com/fine-1/php-SER-libs
- https://github.com/jwt-123/unserialize-lab
- https://github.com/lnick2023/nicenice
- https://github.com/mengdaya/Web-CTF-Cheatsheet
- https://github.com/nixawk/labs
- https://github.com/oneplus-x/MS17-010
- https://github.com/qazbnm456/awesome-cve-poc
- https://github.com/todo1024/2041
- https://github.com/todo1024/2102
- https://github.com/w181496/Web-CTF-Cheatsheet
- https://github.com/wi1shu7/day_day_up
- https://github.com/xbl3/awesome-cve-poc_qazbnm456