CVE-2017-14143

This Metasploit module exploits a PHP object injection vulnerability in Kaltura via a hardcoded cookie secret, allowing unauthenticated RCE through a crafted serialized payload. It leverages a Zend Framework POP chain to execute arbitrary PHP code.

This Metasploit module exploits a PHP object injection vulnerability in Kaltura via a crafted serialized cookie. It leverages a hardcoded cookie secret to bypass signature checks and achieve remote code execution through a Zend Framework deserialization gadget chain.

This exploit leverages a PHP object injection vulnerability in Kaltura <= 13.1.0 via deserialization of a malicious payload in the 'userzone' cookie. It achieves remote code execution by abusing the Zend_Log and Zend_Mail classes to execute arbitrary PHP code.