cve/2011/CVE-2011-4885.md

CVE-2011-4885

Description

PHP before 5.3.9 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.

POC

Reference

• http://www.exploit-db.com/exploits/18305
• http://www.ocert.org/advisories/ocert-2011-003.html
• http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html
• http://www.redhat.com/support/errata/RHSA-2012-0019.html
• https://github.com/FireFart/HashCollision-DOS-POC/blob/master/HashtablePOC.py

Github

No PoCs found on GitHub currently.