CVE-2012-5692

This Metasploit module exploits a PHP unserialize() vulnerability in Invision IP.Board <= 3.3.4 to achieve remote code execution by writing arbitrary PHP code to a file via the __destruct() method of the dbMain class.

This exploit leverages a PHP object injection vulnerability in Invision Power Board <= 3.3.4 via insecure unserialize() usage in cookie handling. It achieves remote code execution by injecting malicious serialized data into the 'member_id' cookie, which triggers the __destruct() method of the 'db_driver_mysql' class to write a PHP shell.

This exploit leverages a PHP object injection vulnerability in Invision Power Board via unsafe unserialize() usage in cookie handling. It bypasses a patch by using a crafted serialized payload to write arbitrary PHP code to a file, achieving remote code execution.

This Metasploit module exploits a PHP unserialize() vulnerability in Invision IP.Board <= 3.3.4, allowing unauthenticated remote code execution via a crafted cookie. It leverages the __destruct() method of the db_driver_mysql class to write arbitrary PHP code to a file in the web directory.