{"vulnerability": "CVE-2017-16894", "sightings": [{"uuid": "5440c2da-714a-4da4-bcfc-39843a94eb02", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-16894", "type": "exploited", "source": "https://www.exploit-db.com/exploits/47129", "content": "", "creation_timestamp": "2019-07-16T00:00:00.000000Z"}, {"uuid": "5fd3ba80-89fa-4434-9b87-3958d20569df", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-16894", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:43.000000Z"}, {"uuid": "5811a280-af59-46ac-ae7a-654893eea12e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-16894", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3llmqimpksq2e", "content": "", "creation_timestamp": "2025-03-30T21:01:58.375840Z"}, {"uuid": "3eb5148c-de8a-4f57-948d-7d70765dfb90", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-16894", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:09:55.000000Z"}, {"uuid": "ab054f50-a65f-49ce-bbc8-0dafedbb4647", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-16894", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3lo57hzydiq2q", "content": "", "creation_timestamp": "2025-05-01T21:03:03.742702Z"}, {"uuid": "b800b9b2-626a-4187-a4df-20e99076d821", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-16894", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/http/laravel_token_unserialize_exec.rb", "content": "", "creation_timestamp": "2019-07-12T14:46:12.000000Z"}, {"uuid": "619ba54d-2951-4814-917e-06d01b097c96", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-16894", "type": "seen", "source": "https://t.me/DarkForums0/1486", "content": "CVE ID : CVE-2017-16894\nSystem : larval framework \nType : sensitive information leak\n\nBug info \ud80c\udda3 :\nThis bug let the attacker get sensitive information from the website like : mysql Credentials, Smtp server Credentials form file named .env found on root directory\nexmple : nimasa.gov.ng/.env", "creation_timestamp": "2024-05-29T10:14:50.000000Z"}, {"uuid": "7fea1d9d-a945-4cf0-ad1c-39b37b40e5b2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-16894", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/http/laravel_token_unserialize_exec.rb", "content": "{\"aliases\": [], \"arch\": \"cmd\", \"author\": [\"St\\u00e5le Pettersen\", \"aushack \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits a vulnerability in the PHP Laravel Framework for versions 5.5.40, 5.6.x <= 5.6.29.\\n          Remote Command Execution is possible via a correctly formatted HTTP X-XSRF-TOKEN header, due to\\n          an insecure unserialize call of the decrypt method in Illuminate/Encryption/Encrypter.php.\\n          Authentication is not required, however exploitation requires knowledge of the Laravel APP_KEY.\\n          Similar vulnerabilities appear to exist within Laravel cookie tokens based on the code fix.\\n          In some cases the APP_KEY is leaked which allows for discovery and exploitation.\", \"disclosure_date\": \"2018-08-07\", \"fullname\": \"exploit/unix/http/laravel_token_unserialize_exec\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:59:31 +0000\", \"name\": \"PHP Laravel Framework token Unserialize Remote Command Execution\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"unknown-reliability\"], \"SideEffects\": [\"unknown-side-effects\"], \"Stability\": [\"unknown-stability\"]}, \"path\": \"/modules/exploits/unix/http/laravel_token_unserialize_exec.rb\", \"platform\": \"Unix\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"unix/http/laravel_token_unserialize_exec\", \"references\": [\"CVE-2018-15133\", \"CVE-2017-16894\", \"URL-https://github.com/kozmic/laravel-poc-CVE-2018-15133\", \"URL-https://laravel.com/docs/5.6/upgrade#upgrade-5.6.30\", \"URL-https://github.com/laravel/framework/pull/25121/commits/d84cf988ed5d4661a4bf1fdcb08f5073835083a0\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"Automatic\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:36.464100Z"}]}