what you don't know can hurt you

Register | Login

FilesNewsUsersAuthors

Home Files News &[SERVICES_TAB]About Contact Add New

Showing 1 - 1 of 1

Files from xorathustra

PEAR Archive_Tar Arbitrary File Write

Posted Jan 25, 2021

Authored by gwillcox-r7, xorathustra | Site metasploit.com

This Metasploit module takes advantages of Archive_Tar versions prior to 1.4.11 which fail to validate file stream wrappers contained within filenames to write an arbitrary file containing user controlled content to an arbitrary file on disk. Note that the file will be written to disk with the permissions of the user that PHP is running as, so it may not be possible to overwrite some files if the PHP user is not appropriately privileged.

tags | exploit, arbitrary, php

advisories | CVE-2020-28949

SHA-256 | 1019e130477e9832a8566af946e7e3daa33b70f86ad034baced9732c7dae0aa5

Download | Favorite | View