CVE-2014-8791

This Metasploit module exploits a PHP object injection vulnerability in Tuleap <= 7.6-4 via an authenticated POST request to 'project/register.php'. It leverages a crafted serialized payload to trigger arbitrary code execution through the destructor method of the Jabbex class.

This Metasploit module exploits a PHP object injection vulnerability in Tuleap <= 7.6-4 via unsafe unserialize() in 'register.php'. It chains gadgets (Jabbex, Jabber, Transition_PostAction_FieldFactory) to execute arbitrary PHP code via eval() after authentication.