critical9.8Public exploit code
CVE-2016-8580
PHP object injection vulnerabilities exist in multiple widget files in AlienVault OSSIM and USM before 5.3.2.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Alienvault OSSIM/USM 5.3.1 - PHP Object Injection2016-11-02 · webapps · php · Verified
- AlienVault OSSIM/USM < 5.3.1 - Remote Code Execution (Metasploit)2017-01-31 · webapps · php
Impact
PHP object injection vulnerabilities exist in multiple widget files in AlienVault OSSIM and USM before 5.3.2. These vulnerabilities allow arbitrary PHP code execution via magic methods in included classes.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Alienvault | Open Source Security Information And Event Management | through 5.3.1 |
| Alienvault | Unified Security Management | through 5.3.1 |
Weakness classification
References
- NVD record
- CVE.org record
- http://www.securityfocus.com/bid/93864
- https://www.alienvault.com/forums/discussion/7766/security-advisory-alienvault-5-3-2-address-70-vulnerabilities
- https://www.exploit-db.com/exploits/40682/
- http://www.securityfocus.com/bid/93864
- https://www.alienvault.com/forums/discussion/7766/security-advisory-alienvault-5-3-2-address-70-vulnerabilities
- https://www.exploit-db.com/exploits/40682/