PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Exploiting GLPI during a Red Team engagement

blog.quarkslab.com | vulnerability | #php | #sql-injection | #red-team | #ssrf | #glpi | #cve-2024-27096
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

During a Red Team engagement, Quarkslab developed a 1-day for GLPI CVE-2023-43813, then found an arbitrary object instantiation leading to SSRF (CVE-2024-27098) and a SQL injection (CVE-2024-27096).
Published
Collected

Related coverage

Critical · vulnerability · github.com
php2shell-zeros: Unpatched 0-Day RCE Flaws and Weaponized Exploit Chains in PHP and NativePHP
These surviving flaws bypass earlier patches and demonstrate that core PHP deserialization and memory management remain fundamentally fragile, posing critical unauthenticated RCE risks to WordPress and production PHP services.
research · github.com
php2shell: Pure HTTP Full-Chain RCE and ASLR Bypass on Stock PHP 8.4 Configurations
Overcomes historical constraints where PHP heap exploitation required display_errors=On, restricted memory limits, or target application vulnerabilities, demonstrating reliable pure-HTTP RCE and ASLR defeat against standard production ini configurations.
tool · github.com
Assetnote Releases php2shell-scanner: High-Fidelity Scanner for CVE-2026-109618 & CVE-2026-109619
As php2shell affects widespread PHP installations globally, this production-grade scanning logic enables enterprise security teams and defenders to reliably audit attack surfaces without relying on destructive exploit payloads.
vulnerability · blog.quarkslab.com
Chamilo LMS... It's raining 0days, hallelujah, it's raining 0days
Chamilo is an open source Learning Management System (LMS) widely deployed in schools and enterprises around the world. In this blogpost we explain how we were able to identify multiple vulnerabilities including a full unauthenticated Remote Code Execution chain in the latest version.
vulnerability · aikido.dev
What you need to know about PHP2shell. Critical vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619)
# What you need to know about PHP2shell. Critical vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) Written by Willem Delbare Published on: Oct 21, 2026 **Update, 15:00 CEST: Patches are...
Critical · vulnerability · github.com
CVE-2026-111497: Unauthenticated WordPress RCE Exploit Chain PoC via Brotli Decoder Flaw
Demonstrates a reliable, real-world weaponization of the Brotli decoder memory corruption flaw in web application environments without requiring information leaks or debugging instrumentation. Highlights the critical risk of untrusted compressed streams in server-side HTTP clients.
Back