Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Exploiting Arbitrary Object Instantiations in PHP without Custom Classes

swarm.ptsecurity.com | research | #rce | #php | #ldap | #object-instantiation | #lam

Summary

A pentest found an unauthenticated Arbitrary Object Instantiation flaw in LAM (LDAP Account Manager) 5.5; with no custom classes available, it was still escalated to remote code execution.
Published
Collected

original ↗

Related coverage

  1. Chamilo LMS... It's raining 0days, hallelujah, it's raining 0days (blog.quarkslab.com)
  2. Hack the Elephant One Bite at a Time: NUL byte SQL Injection in pdo_firebird and NULL Pointer Dereference in PDO via pdo_pgsql (swarm.ptsecurity.com)
  3. Hack the Elephant One Bite at a Time: JPEG-Related Memory-Safety Bugs in PHP (swarm.ptsecurity.com)
  4. Impossible XXE in PHP (swarm.ptsecurity.com)
  5. From opcode to code: how AI chatbots can help with decompilation (swarm.ptsecurity.com)
  6. Attacking MS Exchange Web Interfaces (swarm.ptsecurity.com)

back