CVE-2015-0935

Related Files

Bomgar Remote Support Unauthenticated Code Execution

Posted Jun 15, 2016

Authored by Markus Wulftange | Site metasploit.com

This Metasploit module exploits a vulnerability in the Bomgar Remote Support, which deserializes user provided data using PHP's unserialize method. By providing an specially crafted PHP serialized object, it is possible to write arbitrary data to arbitrary files. This effectively allows the execution of arbitrary PHP code in the context of the Bomgar Remote Support system user. To exploit the vulnerability, a valid Logging Session ID (LSID) is required. It consists of four key-value pairs (i. e., 'h=[...];l=[...];m=[...];t=[...]') and can be retrieved by an unauthenticated user at the end of the process of submitting a new issue via the 'Issue Submission' form. Versions before 15.1.1 are reported to be vulnerable.

tags | exploit, remote, arbitrary, php

advisories | CVE-2015-0935

SHA-256 | 698e0392eb6fd3200601379e4e3d239ebb1d4c3143e7663f8154566abf6dec9c

Download | Favorite | View