2022 Developer Survey is open! Take survey.

Questions tagged [object-injection]

A class of vulnerabilities stemming from deserialization of unsanitized user data.

Filter by
Sorted by
Tagged with
1 vote
1 answer
88 views

Dyanamic class load for server side application

Is there a problem to use reflection (specifically class.forName) in server side application? My main thread about this is someone to inject a code dumping memory in JVM and adding commands in ...
user avatar
1 vote
0 answers
68 views

What's the point of this php shell? [duplicate]

What is the point of this shell code? There is no other code in the file. @preg_match_all("/\t \t(.+)\t\t/Ui",@file_get_contents(__FILE__),$r); $w="";foreach($r[1] as $v){@$w.=@chr(@strlen($v));} $e=...
user avatar
  • 555
0 votes
1 answer
160 views

Why object injection doesn't work but payload is stored along with session cookies on Joomla 2.5.11 unpatched? [closed]

I have read and understand object injection from this question. Then I wanted to test the security issue behind Joomla CMS Object injection through serialization. TEST MACHINE xammp 1.7.3 for ...
user avatar
4 votes
1 answer
761 views

Injected malicious code in temporary files

It just came to my mind that few years ago many iOS applications where infected by XcodeGhost (notably WeChat). This made me think about few possible scenarios: Malicious code injected in object ...
user avatar
2 votes
1 answer
4k views

Insecure Deserialization in C# (.NET) - How to identify and test

I have been reading up on Insecure Deserialization and how it can affect Java applications. https://owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization If the captured traffic data include ...
user avatar
  • 665
4 votes
1 answer
4k views

Is it possible to exploit PHP unserialize without classes? [duplicate]

I'm assessing the security of a webportal for a client and I found a vulnerability. The code is basically doing this: $var = unserialize($_REQUEST['something']); I have complete control over ...
user avatar
  • 335
1 vote
2 answers
3k views

Why does this PHP object injection exploit work?

I have recently created some PHP code vulnerable to object injection. Here is the code of my one.php file where I unserialize the data parameter: <?php class utkarsh { public $logfile = "...
user avatar
14 votes
2 answers
14k views

Variable Assigned to Object Injection Sink (security/detect-object-injection)

I am testing my code on ESLint. It says: Variable Assigned to Object Injection Sink (security/detect-object-injection). I'm not using an outer resource to assign it to my variable, though. Is ...
user avatar
  • 141
2 votes
1 answer
1k views

Is JavaScript object injection exploitable?

I'm testing a site that behaves like this: When I change my username, I submit a POST request with JSON data like this {"username":"John"}. If I change that to for example {"username":{"test":"test"}...
user avatar
  • 2,249
3 votes
3 answers
2k views

Secure method to store PHP object in MySQL database?

How do I securely save PHP objects in a MySQL Database? If you use the serialize and unserialize functions, you may end up with Object Injections. Is there a predefined standard on how to handle this? ...
user avatar
11 votes
2 answers
7k views

Is PHP unserialize() exploitable without any magic methods?

Say that there was a publicly accessible web page with the following PHP code: <?php class NotInteresting { public function noExploits() { echo "Whatever."; } } $unsafe = ...
user avatar
  • 215
1 vote
1 answer
3k views

How can PHP unserialize() object injection be used to bypass authentication?

So I came across with this authentication bypass security notice and the fix for it was just simply changing all serialization to json encoding. I am just wondering how is this really exploitable? ...
user avatar
1 vote
3 answers
4k views

Is using JSON really enough to fix PHP object insertion?

So I was just reading up on the OWASP site about PHP Object Injection. According to their site, the suggested fix is to not use serialze and unserialize but to use json_encode and json_decode. ...
user avatar