Topic: Security: PHP 5.4 Remote Exploit PoC in the wild

[glsmith]

There is a remote exploit in the wild for PHP 5.4.3 in Windows, which takes advantage of a vulnerability in the com_print_typeinfo function. The php engine needs to execute the malicious code, which can include any shellcode like the the ones that bind a shell to a port...

See: http://isc.sans.org/diary/PHP+5+4+Remote+Exploit+PoC+in+the+wild/13255

Exploit: hxxp://www.exploit-db.com/exploits/18861/
(change the hxxp to http to see it)

[Kanashii]

I think this is local code execution !

[glsmith]

Yes, which is why the recommendation was to disable uploads for the time being. If someone uploads it, and calls it, game over.

[Kanashii]

or add to folder:

php_flag engine off

Other problem, when you check file extension by preg_match you need filtr \n && \r



But best way is to run apache on nobody group and add secure rules to allow run only software by admin witch exception to apche bin folder