CVEs-PoC/2016/CVE-2016-2170.md

CVE-2016-2170

Description

Apache OFBiz 12.04.x before 12.04.06 and 13.07.x before 13.07.03 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library.

POC

Reference

• http://packetstormsecurity.com/files/136639/Apache-OFBiz-13.07.02-13.07.01-Information-Disclosure.html
• http://packetstormsecurity.com/files/136639/Apache-OFBiz-13.07.02-13.07.01-Information-Disclosure.html

Github

• https://github.com/ARPSyndicate/cvemon
• https://github.com/AdeliaNitzsche/Java-Deserialization-Cheat-Sheet
• https://github.com/BrittanyKuhn/javascript-tutorial
• https://github.com/GrrrDog/Java-Deserialization-Cheat-Sheet
• https://github.com/PalindromeLabs/Java-Deserialization-CVEs
• https://github.com/klausware/Java-Deserialization-Cheat-Sheet
• https://github.com/mishmashclone/GrrrDog-Java-Deserialization-Cheat-Sheet