{"uuid": "e4b12a8a-3e40-4c4b-9a23-c64fb8201125", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2013-1966", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/struts_include_params.rb", "content": "{\"aliases\": [], \"arch\": \"x86, java\", \"author\": [\"Eric Kobrin\", \"Douglas Rodrigues\", \"Richard Hicks \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits a remote command execution vulnerability in Apache Struts\\n          versions < 2.3.14.2. A specifically crafted request parameter can be used to inject\\n          arbitrary OGNL code into the stack bypassing Struts and OGNL library protections.\\n          When targeting an action which requires interaction through GET, the payload should\\n          be split, taking into account the URI limits. In this case, if the rendered JSP has\\n          more than one point of injection, it could result in payload corruption. This should\\n          happen only when the payload is larger than the URI length.\", \"disclosure_date\": \"2013-05-24\", \"fullname\": \"exploit/multi/http/struts_include_params\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:58:04 +0000\", \"name\": \"Apache Struts includeParams Remote Code Execution\", \"needs_cleanup\": true, \"notes\": {\"Reliability\": [\"unknown-reliability\"], \"SideEffects\": [\"unknown-side-effects\"], \"Stability\": [\"unknown-stability\"]}, \"path\": \"/modules/exploits/multi/http/struts_include_params.rb\", \"platform\": \"Java,Linux,Windows\", \"post_auth\": false, \"rank\": 500, \"ref_name\": \"multi/http/struts_include_params\", \"references\": [\"CVE-2013-2115\", \"CVE-2013-1966\", \"OSVDB-93645\", \"URL-https://cwiki.apache.org/confluence/display/WW/S2-014\", \"URL-http://struts.apache.org/development/2.x/docs/s2-013.html\"], \"rport\": 8080, \"session_types\": false, \"targets\": [\"Windows Universal\", \"Linux Universal\", \"Java Universal\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:15.476517Z"}