CVE-2018-19276

This Metasploit module exploits a Java deserialization vulnerability (CVE-2018-19276) in OpenMRS Platform via a malicious XML payload sent to the Rest API endpoint `/ws/rest/v1/concept`. It achieves unauthenticated remote code execution by leveraging the ImageIO component of the XStream library.

This exploit leverages insecure deserialization in OpenMRS to execute arbitrary commands via a crafted XML payload sent to the REST API, resulting in a reverse shell. The payload uses Java deserialization gadgets to trigger command execution.

This repository contains a functional exploit for CVE-2018-19276, an insecure object deserialization vulnerability in OpenMRS. The exploit leverages a crafted XML payload to achieve remote code execution (RCE) via Java deserialization gadgets.

This Metasploit module exploits a Java deserialization vulnerability in OpenMRS via a malicious XML payload sent to the `/ws/rest/v1/concept` endpoint, achieving unauthenticated RCE. It uses Marshalsec-generated payloads targeting the XStream library's ImageIO component.