Collected research
Exploiting Arbitrary Object Instantiations in PHP without Custom Classes
Exploiting PHP arbitrary object instantiation, where an attacker controls the class name and first constructor argument in new $a($b), using only built-in classes. Passing ImageMagick scheme strings such as vid:msl:/tmp/php* to the Imagick constructor reads attacker-uploaded temporary files and writes a web shell in one unauthenticated request.
Record
- Researcher
- Arseniy Sharoglazov and @_mohemiv
- Published by
- PT SWARM
- Topic
- Server
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of Arseniy Sharoglazov and @_mohemiv, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .