CVE-2014-8791
Tuleap < 7.7 - Authenticated PHP Object Injection via Project Registration Data Parameter
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2014-8791.
PoCs published by Metasploit, including Metasploit module exploits/unix/webapp/tuleap_unserialize_exec.
AI-analyzed exploit summary This Metasploit module exploits a PHP object injection vulnerability in Tuleap <= 7.6-4 via an authenticated POST request to 'project/register.php'. It leverages a crafted serialized payload to trigger arbitrary code execution through the destructor method of the Jabbex class.
Description
project/register.php in Tuleap before 7.7, when sys_create_project_in_one_step is disabled, allows remote authenticated users to conduct PHP object injection attacks and execute arbitrary PHP code via the data parameter.
Exploits (2)
This Metasploit module exploits a PHP object injection vulnerability in Tuleap <= 7.6-4 via an authenticated POST request to 'project/register.php'. It leverages a crafted serialized payload to trigger arbitrary code execution through the destructor method of the Jabbex class.
This Metasploit module exploits a PHP object injection vulnerability in Tuleap <= 7.6-4 via unsafe unserialize() in 'register.php'. It chains gadgets (Jabbex, Jabber, Transition_PostAction_FieldFactory) to execute arbitrary PHP code via eval() after authentication.