CVE-2012-3996

This Metasploit module exploits a PHP unserialize() vulnerability in Tiki Wiki <= 8.3 to achieve remote code execution by leveraging the __destruct() method of the Zend_Pdf_ElementFactory_Proxy class to write arbitrary PHP code to a file on the web server.

This exploit leverages a PHP deserialization vulnerability in Tiki Wiki CMS Groupware <= 8.3 to achieve remote code execution. It constructs a malicious serialized object using Zend Framework classes to write a PHP shell to the target system.