CVE-2026-62120 in Law Office Plugin
Summary
by MITRE • 10/10/2026
Unauthenticated PHP Object Injection in Law Office <= 3.20 versions.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/10/2026
The vulnerability identified as an unauthenticated PHP object injection flaw within the Law Office software, specifically affecting versions up to and including 3.20, represents a critical security deficiency that allows attackers to execute arbitrary code on the target server without requiring valid credentials. This type of vulnerability stems from the improper handling of user-supplied input during the deserialization process in PHP applications. When an application accepts data such as cookies, POST parameters, or URL arguments and passes them directly into functions like unserialize() without adequate validation or sanitization, it creates a pathway for malicious actors to inject crafted serialized objects. In the context of Law Office 3.20, this flaw likely exists within one of its administrative or public-facing modules where input is processed but not strictly typed or filtered before being unserialized by the PHP engine.
From a technical perspective, PHP object injection exploits the magic methods defined in PHP classes, such as __wakeup(), __destruct(), and __toString(). By injecting a serialized string that references an existing class within the application's codebase or included libraries, an attacker can trigger these special functions with controlled parameters. This mechanism allows for remote code execution if dangerous functions like system() or exec() are called indirectly through chained object manipulations known as gadget chains. The severity of this issue is compounded by its unauthenticated nature, meaning that any internet user with network access to the application interface can attempt exploitation without needing a username or password, significantly lowering the barrier for entry and increasing the likelihood of successful compromise in automated scanning environments.
The operational impact of exploiting this vulnerability is severe, potentially leading to full system compromise. An attacker could gain shell access on the web server, allowing them to read sensitive files such as database configuration scripts containing plaintext credentials, modify application logic to create backdoors, or pivot further into the internal network. For a law office software package, which typically handles highly confidential client data including legal documents, personal identification information, and financial records, this breach poses significant risks beyond technical disruption. It violates core principles of confidentiality and integrity defined in security frameworks like CWE-502 for Deserialization of Untrusted Data and aligns with the ATT&CK technique T1059.004 for Command and Scripting Interpreter via PHP execution. The ability to execute arbitrary commands effectively bypasses all authentication controls, rendering traditional access control measures ineffective against this specific attack vector.
Mitigation strategies must focus on immediate remediation of the codebase alongside broader security hardening practices. The primary fix involves upgrading Law Office software to a version where this vulnerability has been patched by the vendor, ensuring that input validation is implemented before any deserialization occurs. Developers should avoid using unserialize() with untrusted data entirely; if object persistence is required, safer alternatives like JSON encoding and decoding should be employed instead of PHP's native serialization format which retains class information vulnerable to injection. Additionally, implementing strict type checking for all inputs and utilizing allowlists for expected variable values can prevent the instantiation of unexpected classes. Security teams should also consider deploying Web Application Firewalls configured with rulesets capable of detecting anomalous serialized payloads in HTTP requests as a temporary compensating control while patches are applied. Regular security audits and static code analysis tools focused on finding unsafe deserialization patterns are essential to preventing similar vulnerabilities from being introduced into the application logic in future updates.