CVE-2016-15044
CRITICALKaltura Video Platform < 11.1.0-2 - Unauthenticated Remote Code Execution via Unsafe Deserialization in keditorservices
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2016-15044.
PoCs published by Mehmet Ince, Security-Assessment.com, Security-Assessment.com, Mehmet Ince <[email protected]>, including Metasploit module exploits/linux/http/kaltura_unserialize_rce.
AI-analyzed exploit summary This Metasploit module exploits a PHP object injection vulnerability in Kaltura's keditorservices module, allowing unauthenticated remote code execution via a crafted serialized payload. The exploit leverages a Zend Framework POP chain to trigger arbitrary command execution.
Description
A remote code execution vulnerability exists in Kaltura versions prior to 11.1.0-2 due to unsafe deserialization of user-controlled data within the keditorservices module. An unauthenticated remote attacker can exploit this issue by sending a specially crafted serialized PHP object in the kdata GET parameter to the redirectWidgetCmd endpoint. Successful exploitation leads to execution of arbitrary PHP code in the context of the web server process.
Exploits (3)
This Metasploit module exploits a PHP object injection vulnerability in Kaltura's keditorservices module, allowing unauthenticated remote code execution via a crafted serialized payload. The exploit leverages a Zend Framework POP chain to trigger arbitrary command execution.
This exploit demonstrates multiple vulnerabilities in Kaltura Community Edition, including unauthenticated remote code execution via PHP deserialization, arbitrary file upload leading to RCE, and SSRF/file read vulnerabilities. The PoC includes detailed steps and code snippets for exploitation.
This Metasploit module exploits a PHP object injection vulnerability in Kaltura's keditorservices module, allowing unauthenticated RCE via a crafted serialized payload. It leverages a Zend Framework POP chain to execute arbitrary PHP code during object deserialization.
References (4)
Scores
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N