CVE-2014-8731 PoC — phpMemcachedAdmin 安全漏洞

Source

https://github.com/sbani/CVE-2014-8731-PoC

Associated Vulnerability

Title:phpMemcachedAdmin 安全漏洞 (CVE-2014-8731)
Description:Memcache是美国软件开发者布莱德-菲兹派翠克（Brad Fitzpatrick）所研发的一套分布式的高速缓存系统。phpMemcachedAdmin是一套基于PHP的用于管理Memcached系统的可视化工具。 PHPMemcachedAdmin 1.2.2及之前的版本中存在安全漏洞。远程攻击者可利用该漏洞执行任意PHP代码。

Description

CVE-2014-8731 - PHPMemcachedAdmin RCE - Proof of Concept

Readme

# CVE-2014-8731-PoC - PHPMemcachedAdmin Remote Code Execution
A proof of concept tool to test your own system if they are vulnerable to CVE-2014-8731

## Blog Post

[PHPMemcachedAdmin Remote Code Execution - CVE-2014-8731 PoC](https://netw0rk.io/blog/phpmemcachedadmin-remote-code-execution-cve-2014-8731-poc/)

## Run test

Start victim server:
```bash
docker run -p8081:80 --rm --name phpma -it alphayax/phpmemcachedadmin
```

Attack victim with PoC:
```bash
git clone https://github.com/sbani/CVE-2014-8731-PoC.git
cd CVE-2014-8731-PoC
python attack.py http://localhost:8081 id
```

## CVE details
> PHPMemcachedAdmin 1.2.2 and earlier allows remote attackers to execute arbitrary PHP code via vectors related "serialized data and the last part of the concatenated filename," which creates a file in webroot.

References:
- https://nvd.nist.gov/vuln/detail/CVE-2014-8731

File Snapshot


 [4.0K]  /data/pocs/49ef4dae324bc6ab47976a93f882e7ac863a2ced
├── [2.6K]  attack.py
└── [ 874]  README.md

0 directories, 2 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!