| शीर्षक | pmTicket Project-Management-Software (https://github.com/issue-tracking-system/Project-Management-Software) up to commit 2ef379da2075f4761a2c9029cf91d073474e7486 Authentication Bypass via Insecure Deserialization |
|---|
| विवरण | This vulnerability exists in the loadLanguage function within the classes/class.database.php file. It occurs because arbitrary user input ($_COOKIE['logged']) is passed directly to the unserialize() function without proper validation. This insecure de-serialization enables an attacker to craft a malicious cookie value, leading to object injection which leads to authentication bypass. |
|---|
| स्रोत | ⚠️ https://asciinema.org/a/kTWHQMM7n6QH98gGCW3e7T9xT |
|---|
| उपयोगकर्ता | Allan Njuguna (UID 57480) |
|---|
| सबमिशन | 17/09/2025 05:09 PM (1 वर्ष पहले) |
|---|
| संयम | 28/09/2025 11:55 AM (11 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 326212 [pmTicket Project-Management-Software तक 2ef379da2075f4761a2c9029cf91d073474e7486 Cookie class.database.php loadLanguage user_id अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|