CVE-2015-6835

This exploit demonstrates a use-after-free vulnerability in PHP's session deserializer (CVE-2015-6835) by crafting a serialized string that manipulates ZVAL references, leading to arbitrary memory control and potential remote code execution.

This repository contains a functional PHP script demonstrating CVE-2015-6835, a PHP session deserialization vulnerability. The PoC exploits insecure session handling to trigger a destructive payload via crafted session data.

This Metasploit module exploits an unauthenticated remote code execution vulnerability in Joomla (CVE-2015-8562) by leveraging PHP deserialization flaws in session handling. It crafts a malicious payload in HTTP headers, which is executed when the session is read from the database.