medium6.0Public exploit code
CVE-2014-8791
project/register.php in Tuleap before 7.7, when sys_create_project_in_one_step is disabled, allows remote authenticated users to conduct PHP object injection a…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Tuleap - PHP Unserialize Code Execution (Metasploit)2014-12-15 · remote · php · Verified
Impact
project/register.php in Tuleap before 7.7, when sys_create_project_in_one_step is disabled, allows remote authenticated users to conduct PHP object injection attacks and execute arbitrary PHP code via the data parameter.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Enalean | Tuleap | Version 7.6 |
Weakness classification
References
- NVD record
- CVE.org record
- http://karmainsecurity.com/KIS-2014-13
- http://packetstormsecurity.com/files/129309/Tuleap-7.6-4-PHP-Object-Injection.html
- http://seclists.org/fulldisclosure/2014/Nov/101
- http://www.securityfocus.com/archive/1/534105/100/0/threaded
- http://www.securityfocus.com/bid/71335
- http://karmainsecurity.com/KIS-2014-13
- http://packetstormsecurity.com/files/129309/Tuleap-7.6-4-PHP-Object-Injection.html
- http://seclists.org/fulldisclosure/2014/Nov/101
- http://www.securityfocus.com/archive/1/534105/100/0/threaded
- http://www.securityfocus.com/bid/71335