rapid7/metasploit-framework — pull request #4341 by EgiX (2014-12-09 09:30:15+00:00)
Title: Add module for CVE-2014-8791: Tuleap PHP Object Injection

This PR contains a module to exploit CVE-2014-8791, a PHP object injection vulnerability in Tuleap before version 7.7 that allows an authenticated user to execute arbitrary code with the permissions of the webserver. The module has been tested successfully on Tuleap 7.5 virtual appliance. Please remember that this will work only if the 'sys_create_project_in_one_step' option is disabled.