I'm trying to understand the PHP Object Injection flaw in vBulletin 5.1.x (CVE 2015-7808) and I stumbled across the requirements for Object Injection as stated by OWASP:
The application must have a class which implements a PHP magic method (such as __wakeup or __destruct) that can be used to carry out malicious attacks, or to start a "POP chain".
Source: https://www.owasp.org/index.php/PHP_Object_Injection
However in this writeup about the vbulletin vulnerability I don't see a magic method being exploited, instead the rewind()
function of class vB_dB_Result
is called because of foreach()
:
public function decodeArguments($arguments){
if ($args = @unserialize($arguments)){
$result = '';
foreach ($args AS $varname => $value){
$result .= $varname;
...
class vB_dB_Result implements Iterator{
...
public function rewind(){
//no need to rerun the query if we are at the beginning of the recordset.
if ($this->bof){
return;
}
if ($this->recordset){
$this->db->free_result($this->recordset);
}
...
abstract class vB_Database{
...
function free_result($queryresult){
$this->sql = '';
return @$this->functions['free_result']($queryresult);
}
Am I missing something or is the OWASP statement simply false in this case?