Questions tagged [object-injection]
A class of vulnerabilities stemming from deserialization of unsanitized user data.
0
votes
1answer
41 views
Why object injection doesn't work but payload is stored along with session cookies on Joomla 2.5.11 unpatched? [closed]
I have read and understand object injection from this question. Then I wanted to test the security issue behind Joomla CMS Object injection through serialization.
TEST MACHINE
xammp 1.7.3 for ...
3
votes
1answer
251 views
Injected malicious code in temporary files
It just came to my mind that few years ago many iOS applications where infected by XcodeGhost (notably WeChat). This made me think about few possible scenarios:
Malicious code injected in object ...
1
vote
1answer
743 views
Insecure Deserialization in C# (.NET) - How to identify and test
I have been reading up on Insecure Deserialization and how it can affect Java applications.
https://owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization
If the captured traffic data include ...
3
votes
1answer
2k views
Is it possible to exploit PHP unserialize without classes? [duplicate]
I'm assessing the security of a webportal for a client and I found a vulnerability. The code is basically doing this:
$var = unserialize($_REQUEST['something']);
I have complete control over ...
1
vote
2answers
901 views
Why does this PHP object injection exploit work?
I have recently created some PHP code vulnerable to object injection. Here is the code of my one.php file where I unserialize the data parameter:
<?php
class utkarsh {
public $logfile = "...
7
votes
2answers
3k views
Variable Assigned to Object Injection Sink (security/detect-object-injection)
I am testing my code on ESLint. It says:
Variable Assigned to Object Injection Sink (security/detect-object-injection).
I'm not using an outer resource to assign it to my variable, though. Is ...
1
vote
1answer
667 views
Is JavaScript object injection exploitable?
I'm testing a site that behaves like this:
When I change my username, I submit a POST request with JSON data like this {"username":"John"}.
If I change that to for example {"username":{"test":"test"}...
3
votes
3answers
1k views
Secure method to store PHP object in MySQL database?
How do I securely save PHP objects in a MySQL Database? If you use the serialize and unserialize functions, you may end up with Object Injections. Is there a predefined standard on how to handle this?
...
9
votes
2answers
6k views
Is PHP unserialize() exploitable without any 'interesting' methods?
Say that there was a publicly accessible web page with the following PHP code:
<?php
class NotInteresting
{
public function noExploits() {
echo "Whatever.";
}
}
$unsafe = ...
1
vote
1answer
2k views
How can PHP unserialize() object injection be used to bypass authentication?
So I came across with this authentication bypass security notice and the fix for it was just simply changing all serialization to json encoding.
I am just wondering how is this really exploitable? ...
1
vote
3answers
2k views
Is using JSON really enough to fix PHP object insertion?
So I was just reading up on the OWASP site about PHP Object Injection. According to their site, the suggested fix is to not use serialze and unserialize but to use
json_encode and json_decode.
...
