### [CVE-2019-11043](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11043)
![](https://img.shields.io/static/v1?label=Product&message=PHP&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=7.1.x%3C%207.1.33%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-120%20Buffer%20Overflow&color=brighgreen)

### Description

In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution.

### POC

#### Reference
- http://packetstormsecurity.com/files/156642/PHP-FPM-7.x-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/156642/PHP-FPM-7.x-Remote-Code-Execution.html
- https://hackerone.com/reports/722327
- https://hackerone.com/reports/722327
- https://usn.ubuntu.com/4166-1/

#### Github
- https://github.com/0th3rs-Security-Team/CVE-2019-11043
- https://github.com/0xT11/CVE-POC
- https://github.com/20142995/pocsuite
- https://github.com/20142995/pocsuite3
- https://github.com/20142995/sectool
- https://github.com/3bdsh/nextcloud
- https://github.com/ARPSyndicate/cvemon
- https://github.com/ARPSyndicate/kenzer-templates
- https://github.com/AleWong/PHP-FPM-Remote-Code-Execution-Vulnerability-CVE-2019-11043-
- https://github.com/B1gd0g/CVE-2019-11043
- https://github.com/BadgerOps/scanner2cpe
- https://github.com/CVEDB/PoC-List
- https://github.com/CVEDB/awesome-cve-repo
- https://github.com/CVEDB/top
- https://github.com/CnHack3r/Penetration_PoC
- https://github.com/EchoGin404/-
- https://github.com/EchoGin404/gongkaishouji
- https://github.com/Elsfa7-110/kenzer-templates
- https://github.com/GhostTroops/TOP
- https://github.com/HxDDD/CVE-PoC
- https://github.com/ITninja04/awesome-stars
- https://github.com/InesMartins31/iot-cves
- https://github.com/JERRY123S/all-poc
- https://github.com/JavierGomezSanchez/cve_exploits
- https://github.com/LubinLew/WEB-CVE
- https://github.com/MRdoulestar/CVE-2019-11043
- https://github.com/Mr-xn/Penetration_Testing_POC
- https://github.com/Ostorlab/KEV
- https://github.com/Ostorlab/known_exploited_vulnerbilities_detectors
- https://github.com/RClueX/Hackerone-Reports
- https://github.com/SexyBeast233/SecBooks
- https://github.com/Threekiii/Awesome-POC
- https://github.com/Threekiii/Vulhub-Reproduce
- https://github.com/Tyro-Shan/gongkaishouji
- https://github.com/XTeam-Wing/RedTeaming2020
- https://github.com/YIXINSHUWU/Penetration_Testing_POC
- https://github.com/ZTK-009/Penetration_PoC
- https://github.com/aaron3238/phpfpmexploit
- https://github.com/ajread4/nessus_crosswalk
- https://github.com/akamajoris/CVE-2019-11043-Docker
- https://github.com/alokaranasinghe/cve-2019-11043
- https://github.com/alphaSeclab/sec-daily-2019
- https://github.com/apachecn-archive/Middleware-Vulnerability-detection
- https://github.com/b0o/starred
- https://github.com/babebbu/TNI-CWC-GGEZ-Hosting
- https://github.com/bakery312/Vulhub-Reproduce
- https://github.com/bollwarm/tech-news
- https://github.com/corifeo/CVE-2019-11043
- https://github.com/cout970/PublicStorage
- https://github.com/cyberanand1337x/bug-bounty-2022
- https://github.com/d4n-sec/d4n-sec.github.io
- https://github.com/dasunwnl/docker-nextcloud
- https://github.com/developer3000S/PoC-in-GitHub
- https://github.com/fairyming/CVE-2019-11043
- https://github.com/febryandana/nginx-php-fpm
- https://github.com/gaahrdner/starred
- https://github.com/hasee2018/Penetration_Testing_POC
- https://github.com/heane404/CVE_scan
- https://github.com/hectorgie/PoC-in-GitHub
- https://github.com/hktalent/TOP
- https://github.com/hugefiver/mystars
- https://github.com/huike007/penetration_poc
- https://github.com/huike007/poc
- https://github.com/huowen/CVE-2019-11043
- https://github.com/hwiwonl/dayone
- https://github.com/ianxtianxt/CVE-2019-11043
- https://github.com/ilikemunchingonwillys/kkk
- https://github.com/imhunterand/hackerone-publicy-disclosed
- https://github.com/izj007/wechat
- https://github.com/jas502n/CVE-2019-11043
- https://github.com/jas9reet/CVE-2019-11043
- https://github.com/jbmihoub/all-poc
- https://github.com/jdecool/stars-feed
- https://github.com/jiangsir404/POC-S
- https://github.com/johnkilene/CUDB
- https://github.com/jptr218/php_hack
- https://github.com/k8gege/CVE-2019-11043
- https://github.com/k8gege/PowerLadon
- https://github.com/konterlim/nextcloud
- https://github.com/kriskhub/CVE-2019-11043
- https://github.com/lindemer/CVE-2019-11043
- https://github.com/linuxserver/docker-nextcloud
- https://github.com/lions2012/Penetration_Testing_POC
- https://github.com/lnick2023/nicenice
- https://github.com/lovechinacoco/https-github.com-mai-lang-chai-Middleware-Vulnerability-detection
- https://github.com/ltfafei/my_POC
- https://github.com/lucianonooijen/stargazed
- https://github.com/m0ver/drupal-installation-issues
- https://github.com/moniik/CVE-2019-11043_env
- https://github.com/motikan2010/blog.motikan2010.com
- https://github.com/neex/phuip-fpizdam
- https://github.com/password520/Penetration_PoC
- https://github.com/qazbnm456/awesome-cve-poc
- https://github.com/rmtec/modeswitcher
- https://github.com/shadow-horse/cve-2019-11043
- https://github.com/supercid/awesome-starred
- https://github.com/superfish9/pt
- https://github.com/tdtc7/qps
- https://github.com/theMiddleBlue/CVE-2019-11043
- https://github.com/tinker-li/CVE-2019-11043
- https://github.com/tjkess/byol
- https://github.com/trhacknon/phuip-fpizdam
- https://github.com/ugur-ercan/exploit-collection
- https://github.com/weeka10/-hktalent-TOP
- https://github.com/whalehub/awesome-stars
- https://github.com/whoadmin/pocs
- https://github.com/whoami13apt/files2
- https://github.com/winterwolf32/CVE-S---Penetration_Testing_POC-
- https://github.com/xbl3/awesome-cve-poc_qazbnm456
- https://github.com/xuetusummer/Penetration_Testing_POC
- https://github.com/yedada-wei/-
- https://github.com/yedada-wei/gongkaishouji
- https://github.com/ypereirareis/docker-CVE-2019-11043
- https://github.com/zhengjim/loophole