Exploit for Deserialization of Untrusted Data in Ibm Sterling_B2B_Integrator

CVE-2015-7450 CVE-2015-7501 CVE-2015-8103 CVE-2016-0792 CVE-2016-1291 CVE-2016-3510

gitee · 2025-08-03

Description

Exploit for deserialization of untrusted data in IBM Sterling B2B Integrator; Java deserialization exploits collection.

Entry point

Parameterobjectname · request body

Path/

Unsafe Java deserialization via SOAP AdminService getAttribute call in IBM WebSphere (CVE-2015-7450)

Affected software

Ibm Sterling b2b Integrator= 5.2

Ibm Sterling Integrator= 5.1

Ibm Tivoli Common Reporting= 2.1, 2.1.1, 2.1.1.2, 3.1, 3.1.0.1, 3.1.0.2, 3.1.2, 3.1.2.1

Ibm Watson Content Analytics≤ 3.0.0.6, 3.5.0.3

All known vulnerabilities by product

Apache Commons Collections Ibm Sterling B2B Integrator Ibm Sterling Integrator Ibm Tivoli Common Reporting Ibm Watson Content Analytics Ibm Watson Explorer Analytical Components Ibm Watson Explorer Annotation Administration Console Ibm Websphere Application Server

CVSS Score

10.0

HIGH SEVERITY

Version 2.0

VectorAV:N/AC:L/Au:N/C:C/I:C/A:C

Attack Vector:NETWORK

Attack Complexity:LOW

Privileges Required:NONE

User Interaction:NONE

Scope:UNCHANGED

Confidentiality:HIGH

Integrity:HIGH

Availability:HIGH

Working code

100%confidence this exploit runs

Based on 14 file(s) in the source

EPSS Score

97.7%higher than 99.9% of all CVEs

Updated 2026-07-20

Exploit Details

Modified:2025-08-03 04:13

Last Seen:2025-09-09 12:12

Reporter:mirrors_Coalfire-Research

Tags

Sterling B2B IntegratorJava Deserialization ExploitsUntrusted Data DeserializationDeserialization Exploits CollectionRemote Code Execution

Other exploits for the same CVE

2026-05-28 panaresh2007GITHUB

Exploit for Improper Input Validation in Jenkins

2025-07-06 mirrors_brianwrfGITEE

Jenkins-CI Unauthenticated Script-Console Scanner

2024-09-01 altonjx, Jeffrey Cap, metasploit.comPACKETSTORMRuby

Vulmap - Web Vulnerability Scanning And Verification Tools

2020-12-25 KitPloitKITPLOIT

Exploit for Code Injection in Microsoft

2020-11-27 ZardccccGITEE

Exploit for Code Injection in Microsoft

2020-11-25 简爱GITEE

Exploit for Code Injection in Microsoft

2020-11-17 baozhazhiziGITEE

Exploit for Deserialization of Untrusted Data in Redhat Data_Grid

2020-10-29 a66asasaGITEE

Exploit Code

MARKDOWN13 lines

## https://sploitus.com/exploit?id=C8514875-7342-5B3F-9AF4-182E0B7C5594
# Java Deserialization Exploits
A collection of curated Java Deserialization Exploits

Currently this repo contains exploits for the following vulnerabilities:

- Cisco Prime Infrastructure Java Deserialization RCE (CVE-2016-1291)
- IBM WebSphere Java Object Deserialization RCE (CVE-2015-7450)
- OpenNMS Java Object Deserialization RCE (No CVE ?)
- Jenkins CLI RMI Java Deserialization RCE (CVE-2015-8103)
- Jenkins Groovy XML RCE (CVE-2016-0792)
- Oracle WebLogic Server Java Object Deserialization RCE (CVE-2016-3510)
- JBoss Java Deserialization RCE (CVE-2015-7501)