Lab 25 — DocuForge — RCE via Dompdf Font Cache Exploitation

hackadvisor

Task: Invoice generation platform using Dompdf 1.2.0 with HTML-enabled memo field and web-accessible font cache directory. Solution: Exploit CVE-2022-28368 by injecting CSS @font-face referencing a remote .php file containing a TTF font with appended PHP webshell; Dompdf caches it with .php extension in a predictable path, enabling RCE.