| タイトル | viames Pair Framework <=1.9.11 PHP Object Injection |
|---|
| 説明 | Pair Framework has a PHP Object Injection vulnerability as a result of Deserialization of Untrusted Data.
(POP/) Gadget Chains exist in Pair Framework (and its libraries) which allow Object Injection vulnerabilities to be exploited, for example to write arbitrary files. Other attacks may be possible depending on what additional code is used in a given project.
Exploitation of the vulnerability does not require authentication and can be achieved by a single GET request. |
|---|
| ソース | ⚠️ https://gist.github.com/mcdruid/1997e10026833d2d1f3e359d75b5912a |
|---|
| ユーザー | mcdruid (UID 79710) |
|---|
| 送信 | 2025年03月06日 22:03 (1 年 ago) |
|---|
| モデレーション | 2025年03月16日 14:25 (10 days later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 299875 [viames Pair Framework 迄 1.9.11 PHP Object /src/UserRemember.php getCookieContent cookieName 特権昇格] |
|---|
| ポイント | 20 |
|---|