Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2018-14667_Lab_POC — Demonstration of the expression language (EL) injection vulnerability CVE-2018-14667 using the photoalbum lab under Jboss application server | Kitploit
Tools/GitHubGitHub/aitlmalem/cve-2018-14667_lab_poc
Vulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingLearning & Education
GitHubaitlmalem/cve-2018-14667_lab_poc

CVE-2018-14667_Lab_POC

Demonstration of the expression language (EL) injection vulnerability CVE-2018-14667 using the photoalbum lab under Jboss application server

View Repository
11h 54m agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2018-14667-Lab

POC for the exploitation of CVE-2018-14667

PREREQUISITES

Demo App From : http://downloads.jboss.org/richfaces/releases/3.3.X/3.3.4.Final/richfaces-examples-3.3.4.Final.zip

Jboss 5.1.0.GA from JBOSS download archive : https://repository.jboss.org/sourceforge/

Jdk-6u45-linux-x64 from JAVA archive : https://www.oracle.com/java/technologies/javase-java-archive-javase6-downloads.html

EXPLOITATION

1 - Install Maven and modify Main.java with the command to execute

image

2 - Run Runer.bash

image

3- Before sending the payload, visit the index page of the photoalbum lab

image

4 - The command is executed succesfully

image

NOTE

The exploit was taken from here and modified to adapt to the JBOSS App Server serialization : https://pastebin.com/raw/YRKdatWv

Download Tool