webPromedium
Lab 25 — DocuForge — RCE via Dompdf Font Cache Exploitation
hackadvisor
Task: Invoice generation platform using Dompdf 1.2.0 with HTML-enabled memo field and web-accessible font cache directory. Solution: Exploit CVE-2022-28368 by injecting CSS @font-face referencing a remote .php file containing a TTF font with appended PHP webshell; Dompdf caches it with .php extension in a predictable path, enabling RCE.
$ ls tags/ techniques/
dompdf_font_cache_rcecss_font_face_injectionphp_webshell_in_ttfpredictable_cache_path_md5
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Sign in with GitHub to continue. No email required.
$sign in$ grep --similar
Similar writeups
- [web][Pro]BillForge— hackadvisor
- [web][Pro]Lab 352 — PipeForge — Content-Type Confusion to Admin JWT Forge to RCE— hackadvisor
- [web][Pro]Lab 58 — ReportForge — SSRF via PDF Export Logo URL— hackadvisor
- [web][Pro]Lab 345 — PrintForge — RCE via Ghostscript Command Injection— hackadvisor
- [web][Pro]Lab 94 — MediaForge — ImageMagick Command Injection via File Upload (ImageTragick)— hackadvisor