cve/2016/CVE-2016-7124.md

CVE-2016-7124

Description

ext/standard/var_unserializer.c in PHP before 5.6.25 and 7.x before 7.0.10 mishandles certain invalid objects, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted serialized data that leads to a (1) __destruct call or (2) magic method call.

POC

Reference

• https://bugs.php.net/bug.php?id=72663
• https://www.tenable.com/security/tns-2016-19

Github

• https://github.com/ARPSyndicate/cvemon
• https://github.com/Fa1c0n35/Web-CTF-Cheatshee
• https://github.com/ProbiusOfficial/PHPSerialize-labs
• https://github.com/Zxser/Web-CTF-Cheatsheet
• https://github.com/duckstroms/Web-CTF-Cheatsheet
• https://github.com/fine-1/php-SER-libs
• https://github.com/jwt-123/unserialize-lab
• https://github.com/lnick2023/nicenice
• https://github.com/mengdaya/Web-CTF-Cheatsheet
• https://github.com/nixawk/labs
• https://github.com/oneplus-x/MS17-010
• https://github.com/qazbnm456/awesome-cve-poc
• https://github.com/todo1024/2041
• https://github.com/todo1024/2102
• https://github.com/w181496/Web-CTF-Cheatsheet
• https://github.com/wi1shu7/day_day_up
• https://github.com/xbl3/awesome-cve-poc_qazbnm456