where $_POST is always an array. I have control over one of the array values, e.g. $_POST['evil']. Is the unserialize exploit possible with this kind of structure?

I coulnd't get it to work with a structure like this:


The usual way to exploit unserialize is to invoke code execution (un-serializing an object triggers the __wakeup method defined in the class using the data supplied). Arrays don't have methods so they cannot be used to exploit this. Note that the class is something already defined serverside.

This does not address a more generic vulnerability in PHP's unserialize function, but the nature of the serialization format and the way PHP manages data in variables makes such a vulnerability unlikely and I am not aware of one.

  • unserializing can trigger more, consider this, but to the nature of the attack "requirements" -> " The application must have a class which implements a PHP magic method (such as __wakeup or __destruct) that can be used to carry out malicious attacks, or to start a "POP chain". All of the classes used during the attack must be declared when the vulnerable unserialize() is being called, otherwise object autoloading must be supported for such classes." these are indeed uncommon attacks yes. – Raymond Nijland Jun 17 '19 at 13:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.