Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2023-34152 — POC for ImageMagick 6.9.6-4. This is a POC which was inspired by fullwaywang discovery of CVE-2023-34152. | Kitploit
Tools/GitHubGitHub/sudoindividual/cve-2023-34152
Vulnerability AnalysisExploitationPenetration TestingPayload DevelopmentBinary Exploitation
GitHubsudoindividual/cve-2023-34152

CVE-2023-34152

POC for ImageMagick 6.9.6-4. This is a POC which was inspired by fullwaywang discovery of CVE-2023-34152.

View Repository
52 years agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2023-34152

RCE vulnerability affecting ImageMagick 6.9.6-4. This vulnerability allows the attacker to execute commands on the victim system. Thus, allowing for Remote Command Execution.

This is a POC which was inspired by fullwaywang discovery of CVE-2023-34152.

Vulnerability Disclosure

root@kitploit:~
Usage: python3 CVE-2023-34152.py Attacker_IP Attacker_Port

Description

an aribitary code execution vulnerability (shell command injection) in OpenBlob, which is actually an incomplete fix to CVE-2016-5118.

CVE-2016-5118 showed that opening any image file whose name starts with a '|' character, ImageMagick will popen the remaining part of the file name. As a fix, it add a configure option --enable-pipes to specially turn on the support of pipes; and also, the invocation of SanitizeString is added before popen_utf8 the filename to suppress aribitary command execution.

However, SanitizeString only filters out characters like single quotes but not ` or ". This allows shell command injection through malformed file name.

Credits: fullwaywang

PATCH

Upgrade to version 7.1.1.10

Download Tool