Description
UNA CMS versions 9.0.0-RC1 - 14.0.0-RC4 contain a PHP object injection vulnerability in BxBaseMenuSetAclLevel.php where the profile_id POST parameter is passed to PHP unserialize() without proper handling, allowing remote, unauthenticated attackers to inject arbitrary PHP objects and potentially write and execute arbitrary PHP code.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | UNA CMS | 9.0.0-RC1 – ≤ 14.0.0-RC4 | — |
References
- ExploitDB-52139 exploit
- UNA CMS Homepage product
- UNA CMS GitHub Repository product
- Karma Security Advisory vdb-entry
- https://www.vulncheck.com/advisories/una-cms-900-rc1-1400-rc4-php-object-injection third-party-advisory