CVE-2014-1691
Horde Application Framework < 5.1.1 - Remote Code Execution via Serialized Object in _formvars
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2014-1691.
PoCs published by Metasploit, EgiX, juan vazquez, including Metasploit module exploits/unix/webapp/horde_unserialize_exec.
AI-analyzed exploit summary This Metasploit module exploits a PHP unserialize vulnerability in Horde Framework <= 5.1.1, leveraging a destructive method chain to achieve arbitrary code execution via a crafted serialized payload.
Description
The framework/Util/lib/Horde/Variables.php script in the Util library in Horde before 5.1.1 allows remote attackers to conduct object injection attacks and execute arbitrary PHP code via a crafted serialized object in the _formvars form.
Exploits (2)
This Metasploit module exploits a PHP unserialize vulnerability in Horde Framework <= 5.1.1, leveraging a destructive method chain to achieve arbitrary code execution via a crafted serialized payload.
This Metasploit module exploits a PHP unserialize vulnerability in Horde Framework <= 5.1.1, leveraging a gadget chain to achieve remote code execution via the `__destruct` method and `call_user_func` call.