CVE-2016-15044

This Metasploit module exploits a PHP object injection vulnerability in Kaltura's keditorservices module, allowing unauthenticated remote code execution via a crafted serialized payload. The exploit leverages a Zend Framework POP chain to trigger arbitrary command execution.

This exploit demonstrates multiple vulnerabilities in Kaltura Community Edition, including unauthenticated remote code execution via PHP deserialization, arbitrary file upload leading to RCE, and SSRF/file read vulnerabilities. The PoC includes detailed steps and code snippets for exploitation.

This Metasploit module exploits a PHP object injection vulnerability in Kaltura's keditorservices module, allowing unauthenticated RCE via a crafted serialized payload. It leverages a Zend Framework POP chain to execute arbitrary PHP code during object deserialization.