CVE-2014-1691

Related Files

Horde Framework Unserialize PHP Code Execution

Posted Jun 29, 2014

Authored by Akra Macha

Horde Framework unserialize PHP code execution exploit ported from Metasploit.

tags | exploit, php, code execution

advisories | CVE-2014-1691

SHA-256 | 04bad0cd117b528d51842d12d0392390ff0e881a1fefd2c2400c4065f7fcbcbe

Download | Favorite | View

Horde Framework Unserialize PHP Code Execution

Posted Mar 20, 2014

Authored by EgiX, juan vazquez | Site metasploit.com

This Metasploit module exploits a php unserialize() vulnerability in Horde versions 5.1.1 and below which could be abused to allow unauthenticated users to execute arbitrary code with the permissions of the web server. The dangerous unserialize() exists in the 'lib/Horde/Variables.php' file. The exploit abuses the __destruct() method from the Horde_Kolab_Server_Decorator_Clean class to reach a dangerous call_user_func() call in the Horde_Prefs class.

tags | exploit, web, arbitrary, php

advisories | CVE-2014-1691

SHA-256 | 29c01edc4c0a6e6872a0827d3816b1b853df5b79ddb58262cb3d16dea0cc69e5

Download | Favorite | View

Debian Security Advisory 2853-1

Posted Feb 6, 2014

Authored by Debian | Site debian.org

Debian Linux Security Advisory 2853-1 - Pedro Ribeiro from Agile Information Security found a possible remote code execution on Horde3, a web application framework. Unsanitized variables are passed to the unserialize() PHP function. A remote attacker could specially-crafted one of those variables allowing her to load and execute code.

tags | advisory, remote, web, php, code execution

systems | linux, debian

advisories | CVE-2014-1691

SHA-256 | 0d04b90771e0f3ac7ebe670486cf9a41d92e4aee95c54d516f3e78cb2a963e1d

Download | Favorite | View