Severe security bug found in popular PHP library for creating PDF files

guest · Mar 19, 2019

Severe security bug found in popular PHP library for creating PDF files
Vulnerability patched last year, but many websites and web apps will most likely remain vulnerable for years
March 19, 2019
https://www.zdnet.com/article/sever...n-popular-php-library-for-creating-pdf-files/

A security researcher has found a severe security flaw in one of the internet's most popular PHP libraries for creating PDF files.

The vulnerability impacts TCPDF, one of the "big three" PHP libraries --together with mPDF and FPDF-- for converting HTML code to PDF docs or assembling PDF files on the fly.
HOW THE NEW TCPDF ATTACK WORKS
In a blog post published over the weekend, an Italian security researcher who goes online as Polict revealed a new PHP serialization flaw impacting TCPDF in the same way as the one discovered by Thomas last year.

It's a very complex attack routine, and it requires advanced PHP coding knowledge to exploit. Deserialization exploits, in general, are hard to uncover and they're the bane of many programming languages, including Ruby, Java, and .NET --besides PHP.
Click to expand...

Log in or Sign up

Severe security bug found in popular PHP library for creating PDF files

guest Guest

Log in or Sign up

Severe security bug found in popular PHP library for creating PDF files

guest Guest

Useful Searches