Exploitation Summary
EIP tracks 3 public exploits for CVE-2015-1592.
PoCs published by Metasploit, lightsey, John Lightsey, including Metasploit module exploits/unix/webapp/sixapart_movabletype_storable_exec.
AI-analyzed exploit summary This Metasploit module exploits a Perl deserialization flaw in MovableType before 5.2.12 to execute arbitrary commands. It supports both nondestructive (requiring additional Perl modules) and destructive (corrupting the installation) attack methods.
Description
Movable Type Pro, Open Source, and Advanced before 5.2.12 and Pro and Advanced 6.0.x before 6.0.7 does not properly use the Perl Storable::thaw function, which allows remote attackers to include and execute arbitrary local Perl files and possibly execute arbitrary code via unspecified vectors.
Exploits (3)
This Metasploit module exploits a Perl deserialization flaw in MovableType before 5.2.12 to execute arbitrary commands. It supports both nondestructive (requiring additional Perl modules) and destructive (corrupting the installation) attack methods.
This repository contains a Metasploit module and Perl scripts that exploit a Perl Storable deserialization vulnerability (CVE-2015-1592) in MovableType before 5.2.12. The exploit achieves remote code execution by leveraging Perl's object deserialization flaws, with both destructive and non-destructive methods.
This Metasploit module exploits a Perl deserialization flaw (CVE-2015-1592) in MovableType before 5.2.12 to achieve remote code execution. It supports both nondestructive (requiring additional Perl modules) and destructive (corrupting the installation) attack methods.