F5 Labs May 2025: PHPUnit CVE-2017-9841 still top-targeted CVE; injection-driven RCE dominates 12-month CWE and OWASP analysis

4 exploits públicos

Há código de exploração publicado no Exploit-DB para CVE-2023-1389, CVE-2017-9841, CVE-2019-9082. O código não é reproduzido aqui: o link leva à fonte, e a explicação foi escrita pela IA a partir do arquivo publicado.

1. exploit-db.com · EDB-51677 ↗ · remoto · hardware · pub. 10/08/2023 não verificado

   TP-Link Archer AX21 - Unauthenticated Command Injection

   This script exploits CVE-2023-1389, a command injection in the web interface of the TP-Link Archer AX21, where the country setting of the locale handler reaches a shell unsanitized. The attacker needs only network reach to the router's web interface, no login, and firmware older than 1.1.4 Build 20230219. Sending the crafted request twice runs commands as root, and here it opens a reverse shell to the attacker. It is a short but working proof of concept that matches the listed CVE.

   CVE-2023-1389 · autor: Voyag3r · explicação gerada por IA
2. exploit-db.com · EDB-50702 ↗ · aplicação web · php · pub. 02/02/2022 não verificado

   PHP Unit 4.8.28 - Remote Code Execution (RCE) (Unauthenticated)

   This script exploits CVE-2017-9841: PHPUnit's eval-stdin helper, when left reachable in a web-exposed vendor directory, executes any PHP code sent in an HTTP request body. The attacker needs only network access to a site that deployed PHPUnit (a dev dependency) publicly, with no login or user interaction. The tool checks several common framework layouts with a harmless test, then offers an interactive prompt that runs system commands as the web server user. It is a simple, working exploit that matches the CVE.

   CVE-2017-9841 · autor: souzo · explicação gerada por IA
3. exploit-db.com · EDB-48333 ↗ · remoto · linux · pub. 16/04/2020 verificado

   ThinkPHP - Multiple PHP Injection RCEs (Metasploit)

   This Metasploit module exploits remote code execution in the ThinkPHP 5.x web framework through the public index page, where a crafted request makes the framework call a PHP function with attacker-chosen input. The attacker needs only network access to the web server, with no login or user interaction, and a ThinkPHP version up to 5.0.23. The module reads the version from an error page and picks one of two techniques, one per CVE. It runs system commands as the web server user and can drop a Linux payload for a remote session. It is a mature, working exploit.

   CVE-2019-9082 · autor: Metasploit · explicação gerada por IA

1. exploit-db.com · EDB-46488 ↗ · aplicação web · php · pub. 04/03/2019 não verificado

   zzzphp CMS 1.6.1 - Cross-Site Request Forgery

   This is a cross-site request forgery proof of concept against the zzzphp CMS 1.6.1 admin panel, in the template file editing function. The admin save form has no anti-CSRF token, so a malicious web page can silently submit a forged edit. The attacker only needs to lure a logged-in administrator to that page; no credentials or local access are required. The forged edit writes a PHP expression into a site template, which the CMS later evaluates, leading to remote code execution. It is a simple, working-looking PoC (unverified), and the author describes it as a follow-up to CVE-2019-9041.

   CVE-2019-9082 · autor: Yang Chenglong · explicação gerada por IA

Detalhes técnicos

Remediação