[B! security][php] dazedã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

dazed id:dazed

securityã¨phpã«é–¢ã™ã‚‹dazedã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (5)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

æ”»æ’ƒè€…ãŒæŽ¡ç”¨ã—ãŸã€Œ.htaccessã€ã‚’æ”¹ã–ã‚“ã—ã¦ã€ä»»æ„ã®æ‹¡å¼µåã§PHPã‚’å®Ÿè¡Œã™ã‚‹æ–¹æ³•
ã¿ãªã•ã‚“ã€ã“ã‚“ã«ã¡ã¯ã€‚mï¼ˆ@the_art_of_nerdï¼‰ã§ã™ã€‚ ä»Šå›žã¯ç§ãŒWebã‚µãƒ¼ãƒãƒ¼ã‚’ãƒ•ã‚©ãƒ¬ãƒ³ã‚¸ãƒƒã‚¯èª¿æŸ»ã‚’æ‹…å½“ã—ãŸéš›ã«ç™ºè¦‹ã—ãŸã€ä»»æ„ã®æ‹¡å¼µåã‹ã‚‰PHPã‚’å®Ÿè¡Œã™ã‚‹æ–¹æ³•ã«ã¤ã„ã¦ç´¹ä»‹ã—ã¾ã™ã€‚ èƒŒæ™¯ Webã‚µãƒ¼ãƒãƒ¼ãŒæ”»æ’ƒè€…ã«ã‚ˆã£ã¦ä¾µå®³ã•ã‚ŒãŸã¨ã„ã†äº‹æ¡ˆã§ã€ãƒ•ã‚©ãƒ¬ãƒ³ã‚¸ãƒƒã‚¯èª¿æŸ»ã‚’å®Ÿæ–½ã—ãŸéš›ã«ç™ºè¦‹ã—ãŸãƒ†ã‚¯ãƒ‹ãƒƒã‚¯ã§ã™ã€‚ï¼ˆæ£è¦ã®ä»•æ§˜ã‚’æ‚ªç”¨ï¼‰ Webã‚µãƒ¼ãƒãƒ¼ã®ä¾µå®³ã®ãŸã‚ã€WebShellã®è¨ç½®ã‚’ç–‘ã„ã€ã¾ãšæ‹¡å¼µåãƒ™ãƒ¼ã‚¹ã§ä¸å¯©ãªãƒ•ã‚¡ã‚¤ãƒ«ï¼ˆæ”¹ã–ã‚“ãƒ»ä½œæˆï¼‰ãŒå˜åœ¨ã—ãªã„ã‹èª¿æŸ»ã—ã¦ã„ãŸã¨ã“ã‚ã€ã„ãã¤ã‹ä¸å¯©ãªãƒ•ã‚¡ã‚¤ãƒ«ã¯ç™ºè¦‹ã•ã‚Œã¾ã—ãŸãŒã€ã©ã†ã—ã¦ã‚‚WebShellã®ã‚ˆã†ãªæ©Ÿèƒ½ã‚’æœ‰ã™ã‚‹ãƒ•ã‚¡ã‚¤ãƒ«ã ã‘è¦‹ã¤ã‹ã‚Šã¾ã›ã‚“ã§ã—ãŸã€‚ ãã“ã§ã€æ‹¡å¼µåã§è¦‹ã¦ã„ãèª¿æŸ»ã‹ã‚‰å„ãƒ‡ã‚£ãƒ¬ã‚¯ãƒˆãƒªã”ã¨ã«æ°—ã«ãªã‚‹ãƒ•ã‚¡ã‚¤ãƒ«ãŒå˜åœ¨ã—ãªã„ã‹ã®èª¿æŸ»ã«åˆ‡ã‚Šæ›¿ãˆãŸã¨ã“ã‚ã€1ã¤ã ã‘æ˜Žã‚‰ã‹ã«Webã‚µãƒ¼ãƒãƒ¼ã®ã‚³ãƒ³ãƒ†ãƒ³ãƒ„ã¨ã—ã¦é•å’Œæ„Ÿã®ã‚ã‚‹"ãƒ•ã‚¡ã‚¤ãƒ«å"ãŒä»˜ã‘ã‚‰ã‚ŒãŸCSSãƒ•ã‚¡
dazed 2024/12/12
security

php

htaccess

apache
ãƒªãƒ³ã‚¯
JVN#70100915: TransmitMail ã«ãŠã‘ã‚‹è¤‡æ•°ã®è„†å¼±æ€§
TransmitMail ã¯ã€PHP ã§å‹•ä½œã™ã‚‹ãƒ¡ãƒ¼ãƒ«ãƒ•ã‚©ãƒ¼ãƒ ã‚·ã‚¹ãƒ†ãƒ ã§ã™ã€‚TransmitMail ã«ã¯ã€æ¬¡ã®è¤‡æ•°ã®è„†å¼±æ€§ãŒå˜åœ¨ã—ã¾ã™ã€‚ å¤–éƒ¨å…¥åŠ›å€¤ã®æ¤œè¨¼ä¸å‚™ã«èµ·å› ã™ã‚‹ãƒ‡ã‚£ãƒ¬ã‚¯ãƒˆãƒªãƒˆãƒ©ãƒãƒ¼ã‚µãƒ« (CWE-22) - CVE-2022-22146
dazed 2022/01/25
php

mail

security
ãƒªãƒ³ã‚¯
ã€PHPã€‘ä½œæˆã—ãŸãƒ¡ãƒ¼ãƒ«ãƒ•ã‚©ãƒ¼ãƒ ã«è„†å¼±æ€§ãŒãªã„ã‹ã€ã‚¢ãƒ‰ãƒã‚¤ã‚¹ã‚‚ã‚‰ãˆãªã„ã§ã—ã‚‡ã†ã‹ã€‚
PHPã¯ã€Webã‚µã‚¤ãƒˆæ§‹ç¯‰ã«ç‰¹åŒ–ã—ã¦é–‹ç™ºã•ã‚ŒãŸãƒ—ãƒã‚°ãƒ©ãƒŸãƒ³ã‚°è¨€èªžã§ã™ã€‚å¤§ããªç‰¹å¾´ã®ã²ã¨ã¤ã¯ã€HTMLã«ç›´æŽ¥ãƒ—ãƒã‚°ãƒ©ãƒ ã‚’åŸ‹ã‚è¾¼ã‚€ã“ã¨ãŒã§ãã‚‹ã¨ã„ã†ç‚¹ã§ã™ã€‚PHPã‚’ç”¨ã„ã‚‹ã“ã¨ã§ã€HTMLã‚’å‹•çš„ã‚³ãƒ³ãƒ†ãƒ³ãƒ„ã¨ã—ã¦å‡ºåŠ›ã§ãã¾ã™ã€‚HTMLãŒãã®ã¾ã¾ãƒ–ãƒ©ã‚¦ã‚¶ã«è¡¨ç¤ºã•ã‚Œã‚‹ã®ã«å¯¾ã—ã€PHPãƒ—ãƒã‚°ãƒ©ãƒ ã¯ã‚µãƒ¼ãƒå´ã§å®Ÿè¡Œã•ã‚ŒãŸçµæžœãŒãƒ–ãƒ©ã‚¦ã‚¶ã«è¡¨ç¤ºã•ã‚Œã‚‹ãŸã‚ã€PHPã‚¹ã‚¯ãƒªãƒ—ãƒˆã¯ã€Œã‚µãƒ¼ãƒã‚µã‚¤ãƒ‰ã‚¹ã‚¯ãƒªãƒ—ãƒˆã€ã¨å‘¼ã°ã‚Œã¦ã„ã¾ã™ã€‚
dazed 2017/04/10
security

php

mail

form
ãƒªãƒ³ã‚¯
PHPMailerã®è„†å¼±æ€§ CVE-2016-10033ï¼CVE-2016-10045ã«ã¤ã„ã¦ã¾ã¨ã‚ã¦ã¿ãŸ - piyolog
2016å¹´12æœˆ25æ—¥ã€PHPã®ãƒ¡ãƒ¼ãƒ«é€ä¿¡ãƒ©ã‚¤ãƒ–ãƒ©ãƒªPHPMailerã«ä»»æ„ã®ã‚³ãƒ¼ãƒ‰å®Ÿè¡Œå¯èƒ½ãªè„†å¼±æ€§ãŒç¢ºèªã•ã‚ŒãŸã¨ã—ã¦æƒ…å ±ãŒå…¬é–‹ã•ã‚Œã¾ã—ãŸã€‚ã“ã“ã§ã¯è„†å¼±æ€§ã®é–¢é€£æƒ…å ±ã‚’ã¾ã¨ã‚ã¾ã™ã€‚ è„†å¼±æ€§ã®æ¦‚è¦ å¯¾è±¡ PHPMailer CVE CVE-2016-10033 CVE-2016-10045 å½±éŸ¿ RCE é‡è¦åº¦ Critical(ç™ºè¦‹è€…) ç·Šæ€¥(JVN) CVSS JPCERT/CCè©•ä¾¡ CVSSv3ï¼š5.4 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) CVSSv2ï¼š5.5 (AV:N/AC:L/Au:S/C:P/I:P/A:N) PoC ã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆä¸Šã«å…¬é–‹æ¸ˆ CVE-2016-10033â‡’2016/12/26 CVE-2016-10045â‡’2016/12/28 ç™ºè¦‹è€…/å ±å‘Šè€… CVE-2016-10033:Dawid Golunskiæ°(
dazed 2017/01/05
php

mail

wordpress

security
ãƒªãƒ³ã‚¯
[ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£]ç”»åƒã¸ã®PHPã‚³ãƒžãƒ³ãƒ‰æŒ¿å…¥ â€• T.Teradaã®æ—¥è¨˜
ã ã„ã¶æ™‚é–“ãŒãŸã£ã¦ã—ã¾ã„ã¾ã—ãŸãŒã€å¤§åž£ã•ã‚“ã®ä»¥ä¸‹ã®ãƒ–ãƒã‚°ã«ã‚³ãƒ¡ãƒ³ãƒˆã—ãŸã“ã¨ãªã©ã‚’ã¾ã¨ã‚ã¾ã™ã€‚ ç”»åƒãƒ•ã‚¡ã‚¤ãƒ«ã«PHPã‚³ãƒ¼ãƒ‰ã‚’åŸ‹ã‚è¾¼ã‚€æ”»æ’ƒã¯æ—¢çŸ¥ã®å•é¡Œ â€“ yohgaki's blog ã‚¢ãƒƒãƒ—ãƒãƒ¼ãƒ‰ç”»åƒã‚’åˆ©ç”¨ã—ãŸæ”»æ’ƒã«ã¤ã„ã¦ã§ã™ã€‚ æ”»æ’ƒã®æ¦‚è¦ ç”»åƒãƒ•ã‚¡ã‚¤ãƒ«ã«PHPã‚³ãƒžãƒ³ãƒ‰ã‚’æŒ¿å…¥ã™ã‚‹æ”»æ’ƒã¯ã€å¤§ãã2ç¨®é¡žã«åˆ†ã‘ã‚‹ã“ã¨ãŒã§ãã¾ã™ã€‚ 1ã¤ã¯ã€ç”»åƒã®ã‚¢ãƒƒãƒ—ãƒãƒ¼ãƒ‰æ©Ÿèƒ½ã‚’æŒã¤ã‚µã‚¤ãƒˆè‡ªèº«ã‚’ç‹™ã†æ”»æ’ƒã§ã™ã€‚PHPã§é–‹ç™ºã•ã‚Œã¦ãŠã‚Šã€ä»»æ„ã®æ‹¡å¼µåã®ãƒ•ã‚¡ã‚¤ãƒ«ã®ã‚¢ãƒƒãƒ—ãƒãƒ¼ãƒ‰ã‚’è¨±ã™ã‚µã‚¤ãƒˆã§ã¯ã€æ‹¡å¼µåãŒphpãªã©ã®ãƒ•ã‚¡ã‚¤ãƒ«ã‚’ã‚¢ãƒƒãƒ—ãƒãƒ¼ãƒ‰ã•ã‚Œã‚‹æã‚ŒãŒã‚ã‚Šã¾ã™ã€‚ æ‹¡å¼µåãŒphpãªã©ã®ãƒ•ã‚¡ã‚¤ãƒ«ã«ä»•è¾¼ã¾ã‚ŒãŸPHPã‚³ãƒžãƒ³ãƒ‰ã¯ã€ãã®ãƒ•ã‚¡ã‚¤ãƒ«ã«HTTP/HTTPSã§ã‚¢ã‚¯ã‚»ã‚¹ã•ã‚ŒãŸéš›ã«å®Ÿè¡Œã•ã‚Œã¾ã™ã€‚æ”»æ’ƒè€…ã¯ã€ã‚¢ãƒƒãƒ—ãƒãƒ¼ãƒ‰ãƒ•ã‚¡ã‚¤ãƒ«ã‚’é€šã˜ã¦ã€ç”»åƒãŒç½®ã‹ã‚Œã‚‹Webã‚µãƒ¼ãƒä¸Šã§ä»»æ„ã®ã‚³ãƒžãƒ³ãƒ‰ã‚’å®Ÿè¡Œã™ã‚‹ã“ã¨ã§ãã¾ã™ã€‚ ã“ã®è„†å¼±æ€§ã¯ã€ã‚¢ãƒƒãƒ—ãƒãƒ¼ãƒ‰å¯èƒ½ãªãƒ•
dazed 2007/07/17
security

php
ãƒªãƒ³ã‚¯
1