CVE-2015-6835
CVE-2015-6835
The session deserializer in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 mishandles multiple php_var_unserialize calls, which allow remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via crafted session content.
Affected products
n/a · n/apublic PoCs found — 2
githubgithub.com/ockeghem/CVE-2015-6835-checker★ 3exploitdbwww.exploit-db.com/exploits/38123unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Want to know if your infrastructure is exposed to this?
Talk to TrueHacking →