CVE-2015-2348PoC(apple / enterprise_linux_desktop)

MEDIUMCVSS 5.0 · MEDIUM

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Prioritize remediation for apple enterprise_linux_desktop systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft
Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

The move_uploaded_file implementation in ext/standard/basic_functions.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 truncates a pathname upon encountering a \x00 character, which allows remote attackers to bypass intended extension restrictions and create files with unexpected names via a crafted second argument. NOTE: this vulnerability exists because of an incomplete fix for CVE-2006-7243.

apple CVEs Back to dashboard

4.5/ 10 priority

Sources & remediation

Exploit / PoC references

Other references

Weakness type (CWE)

CWE-264

Priority

MEDIUM

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

enterprise_linux_desktop
enterprise_linux_hpc_node
enterprise_linux_hpc_node_eus
enterprise_linux_server

Threat summary

Public PoC and exploit tooling are both present
1 mentions across 1 observed day

What's happening

Exploit tool or code specified in 1 signal
PoC mentioned or linked in 1 signal
Technical details provided in 1 signal
1 total mentions across 1 day

Affected systems

Vendors

apple opensuse php redhat

Products

enterprise_linux_desktopenterprise_linux_hpc_nodeenterprise_linux_hpc_node_eusenterprise_linux_serverenterprise_linux_server_eusenterprise_linux_workstationmac_os_xopensusephp

34 versions affected across 9 products

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

PoC

1100.0%

Referenced assets1 URL

By indicator

https://shorturl.at/4VRnM

Full discourse1 post

Aryan Gupta@aryan_s8h224d
PoC
@intigriti its clear that the name is user controlled, what one can do is simply just add ../../ for path traversal... but i found out this CVE-2015-2348 and https://shorturl.at/4VRnM basically use a null byte in filename to save it as a .php and boom issue was the move_uploaded_file func
Post summary
The user references CVE-2015-2348, links to a PoC, and explains a null-byte filename exploitation using move_uploaded_file.
10031203
9 followersView on X

CPE platform detail60 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

60 of 60 entries

Part	Vendor	Product	Version	Target SW	Target HW
OS	apple	mac_os_x	-	-	-
OS	opensuse	opensuse	13.1	-	-
OS	opensuse	opensuse	13.2	-	-
App	php	php	-	-	-
App	php	php	5.5.0	-	-
App	php	php	5.5.0	-	-
App	php	php	5.5.0	-	-
App	php	php	5.5.0	-	-
App	php	php	5.5.0	-	-
App	php	php	5.5.0	-	-
App	php	php	5.5.0	-	-
App	php	php	5.5.0	-	-
App	php	php	5.5.0	-	-
App	php	php	5.5.0	-	-
App	php	php	5.5.0	-	-
App	php	php	5.5.0	-	-
App	php	php	5.5.0	-	-
App	php	php	5.5.1	-	-
App	php	php	5.5.10	-	-
App	php	php	5.5.11	-	-
App	php	php	5.5.12	-	-
App	php	php	5.5.13	-	-
App	php	php	5.5.14	-	-
App	php	php	5.5.15	-	-
App	php	php	5.5.16	-	-
App	php	php	5.5.17	-	-
App	php	php	5.5.18	-	-
App	php	php	5.5.19	-	-
App	php	php	5.5.2	-	-
App	php	php	5.5.20	-	-
App	php	php	5.5.21	-	-
App	php	php	5.5.22	-	-
App	php	php	5.5.3	-	-
App	php	php	5.5.4	-	-
App	php	php	5.5.5	-	-
App	php	php	5.5.6	-	-
App	php	php	5.5.7	-	-
App	php	php	5.5.8	-	-
App	php	php	5.5.9	-	-
App	php	php	5.6.0	-	-
App	php	php	5.6.0	-	-
App	php	php	5.6.0	-	-
App	php	php	5.6.0	-	-
App	php	php	5.6.0	-	-
App	php	php	5.6.0	-	-
App	php	php	5.6.0	-	-
App	php	php	5.6.0	-	-
App	php	php	5.6.0	-	-
App	php	php	5.6.1	-	-
App	php	php	5.6.2	-	-
App	php	php	5.6.3	-	-
App	php	php	5.6.4	-	-
App	php	php	5.6.5	-	-
App	php	php	5.6.6	-	-
OS	redhat	enterprise_linux_desktop	7.0	-	-
OS	redhat	enterprise_linux_hpc_node	7.0	-	-
OS	redhat	enterprise_linux_hpc_node_eus	7.1	-	-
OS	redhat	enterprise_linux_server	7.0	-	-
OS	redhat	enterprise_linux_server_eus	7.1	-	-
OS	redhat	enterprise_linux_workstation	7.0	-	-

Explore more

Back to dashboard apple CVEs opensuse CVEs php CVEs enterprise_linux_desktop vulnerabilities