CVE-2015-6835
CRITICALJoomla HTTP Header Unauthenticated Remote Code Execution
Title source: metasploitExploitation Summary
EIP tracks 3 public exploits for CVE-2015-6835.
PoCs published by Taoguang Chen, ockeghem, Marc-Alexandre Montpas, Christian Mehlmauer, including Metasploit module exploits/multi/http/joomla_http_header_rce.
AI-analyzed exploit summary This exploit demonstrates a use-after-free vulnerability in PHP's session deserializer (CVE-2015-6835) by crafting a serialized string that manipulates ZVAL references, leading to arbitrary memory control and potential remote code execution.
Description
The session deserializer in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 mishandles multiple php_var_unserialize calls, which allow remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via crafted session content.
Exploits (3)
This exploit demonstrates a use-after-free vulnerability in PHP's session deserializer (CVE-2015-6835) by crafting a serialized string that manipulates ZVAL references, leading to arbitrary memory control and potential remote code execution.
This repository contains a functional PHP script demonstrating CVE-2015-6835, a PHP session deserialization vulnerability. The PoC exploits insecure session handling to trigger a destructive payload via crafted session data.
This Metasploit module exploits an unauthenticated remote code execution vulnerability in Joomla (CVE-2015-8562) by leveraging PHP deserialization flaws in session handling. It crafts a malicious payload in HTTP headers, which is executed when the session is read from the database.
References (6)
Scores
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H