Description
PHP FPM存在远程代码执行漏洞。该漏洞是由于fpm_main.c对用户输入的数据验证不足导致的。
PHP FPM fpm_main.c 远程代码执行漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://www.mycert.org.my/portal/advisory?id=MA-756.102019
https://www.anquanke.com/post/id/189415
https://blog.orange.tw/posts/2019-10-an-analysis-and-thought-about-recently/
https://www.secpod.com/blog/php-rce-exploited-in-the-wild-cve-2019-11043
https://cloud.tencent.com/developer/article/1536640
https://hackerone.com/reports/722327
https://www.tenablecloud.cn/plugins/nessus/136744
https://www.svenbeast.com/post/dyp738nRt/
https://bugs.php.net/78599
https://nsfocusglobal.com/php-fpm-remote-code-execution-vulnerability-cve-2019-11043-threat-alert/
https://www.dptech.com/index.php?m=content&c=index&a=show&catid=1695&id=1845
https://developer.jdcloud.com/article/767
https://www.tenable.com/blog/cve-2019-11043-vulnerability-in-php-fpm-could-lead-to-remote-code-execution-on-nginx
https://www.nsfocus.com.cn/html/2019/39_1025/829.html
https://blog.detectify.com/product-updates/cve-2019-11043-nginx-php-fpm-exploit/
https://nvd.nist.gov/vuln/detail/CVE-2019-11043