Description
Cotonti 1.0.0 Comments plugin passes the ci GET parameter to unserialize() without allowed_classes restriction, allowing unauthenticated attackers to instantiate arbitrary PHP classes with attacker-controlled properties. Attackers can exploit PHP object injection through crafted serialized payloads to trigger gadget chains and achieve database manipulation or code execution.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Cotonti | Cotonti | 1.0.0 – ≤ 1.0.0 | — |
References
- GitHub Issue #1888 issue-tracking
- Proposed fix PR #1889 (unmerged) patch issue-tracking
- CommentsWidget::run() at 1.0.0 technical-description
- AJAX display controller at 1.0.0 technical-description
- Default comments permissions at 1.0.0 technical-description
- https://github.com/Cotonti/Cotonti product
- VulnCheck Advisory: Cotonti 1.0.0 Comments Plugin PHP Object Injection via ci Parameter third-party-advisory