Loading vulnerability…
CVE-2025-14177 is an information disclosure vulnerability in PHP’s ext/standard image-processing code affecting getimagesize() when parsing JPEG APPn segments in multi-chunk read scenarios. The flaw affects PHP 8.1 before 8.1.34, 8.2 before 8.2.30, 8.3 before 8.3.29, 8.4 before 8.4.16, and 8.5 before 8.5.1. The root cause is incorrect buffer handling in php_read_stream_all_chunks(), where successive reads overwrite the beginning of the destination buffer without advancing the write pointer, leaving trailing bytes of the allocated heap buffer uninitialized. When getimagesize() returns APP segment metadata, those uninitialized tail bytes can be exposed to userland as part of the APPn data. This can disclose residual heap contents from the PHP process and compromise confidentiality on servers that process attacker-supplied images or streams.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos.
Repository contains a single Python exploit generator (CVE-2025-14177.py) and a README. The Python script is a standalone proof-of-concept/operational exploit helper for CVE-2025-14177, a PHP getimagesize() heap memory disclosure issue caused by php_read_stream_all_chunks() overwriting buffer offsets during multi-chunk reads. Its main capability is generating a malicious JPEG with an oversized APP1 segment sized to exceed the 8KB chunk boundary, thereby modeling the vulnerable condition where later chunks overwrite earlier data and the returned APP1 metadata may contain uninitialized heap bytes. The script supports multiple modes (demo, gen, test, analyze, flow), writes artifacts into ./exploit_output/, simulates heap spray/leak behavior, analyzes leaked bytes for recognizable patterns, and emits JSON reports/test cases plus generated PHP helper code. No live exploitation against a hardcoded remote target is present; instead, the repository focuses on payload generation, simulation, and deployment guidance. Fingerprintable observables are mostly local artifact paths and PHP stream-wrapper strings, plus README examples of likely target-side endpoints such as php://filter resource paths, upload handling via $_FILES, and a sample /preview.php?url=attacker.com/malicious.jpg remote-fetch scenario.
This repository is a standalone Bash-based exploit toolkit centered on PHP8.1.x_Exploit.sh, which orchestrates detection and exploitation of four PHP CVEs using modular helper scripts under modules/. The main script normalizes target URLs, fingerprints OS and PHP version via HTTP headers and a phpinfo.php probe, crawls homepage links/forms, enumerates likely CGI and upload endpoints, and then invokes per-CVE modules. The repository structure is simple: one main driver script, four CVE-specific Bash modules, one shared utils module, and a README. Primary exploit capability is CVE-2024-4577 against Windows PHP-CGI. The module tests two query-string injection variants, including a soft-hyphen bypass, by setting allow_url_include and auto_prepend_file=php://input and POSTing PHP code. On success it either demonstrates command execution with whoami or launches a PowerShell reverse shell to an operator-supplied IP/port. This is a real exploitation path providing RCE. A second remote capability targets CVE-2025-14177 by generating malformed JPEG files and POSTing them to discovered upload endpoints using multipart form field file. Detection looks for a marker string or long printable output in responses; exploitation repeats the upload 10 times and stores raw responses and extracted strings under a reports subdirectory, aiming to capture leaked heap data. The remaining two modules, CVE-2025-14180 and CVE-2025-14178, are effectively local/RCE-follow-on checks and crash payloads rather than pure remote exploits. Both use php -r locally when PHP CLI is present; the exploit functions POST PHP snippets to a target URL if remote code execution is already available. CVE-2025-14180 attempts to trigger a PDO PostgreSQL null dereference using DSN pgsql:host=localhost;dbname=postgres with emulated prepares enabled. CVE-2025-14178 attempts an array_merge integer overflow by allocating extremely large arrays. Both are described as potentially crashing or destabilizing the PHP process. Overall, this is an operational multi-CVE web exploitation script, not just a detector. It supports single-target and batch modes, optional GNU parallel execution, report logging, and automatic exploitation unless scan-only is specified. Fingerprintable targets include common CGI paths, common upload paths, phpinfo.php probing, php://input injection, localhost PostgreSQL access, and attacker-defined reverse-shell callback endpoints.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
19 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An information disclosure vulnerability in PHP’s getimagesize handling of JPEG APP segments caused by incorrect chunk concatenation in php_read_stream_all_chunks, which can expose uninitialized heap memory.
A heap memory disclosure vulnerability in PHP's getimagesize function where JPEG APP segment data could include uninitialized heap bytes due to incorrect chunk concatenation during multi-chunk reads.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.