CVE-2013-1488

This Metasploit module exploits CVE-2013-1488, a vulnerability in Java's DriverManager class where the toString() method is called on user-supplied classes within a doPrivileged block, leading to remote code execution. It bypasses click-to-play on Internet Explorer via a crafted JNLP file and targets Java 7u17 and earlier.

This is a working PoC exploit for CVE-2013-1488, a Java vulnerability that bypasses the security manager to execute arbitrary code. It leverages the ServiceLoader and ScriptEngine to achieve remote code execution by disabling the security manager and executing a command (calc.exe).

This Metasploit module exploits CVE-2013-1488 in Java 7u17 and earlier by abusing the java.sql.DriverManager class's toString() method in a doPrivileged block, achieving remote code execution via a crafted JNLP file and bypassing click-to-play on Internet Explorer.