Authorized PHP Object Injection

[Xyntax]

https://github.com/intelliants/subrion/blob/develop/includes/classes/ia.core.users.php#L709

if (isset($_COOKIE['salt']) && $_COOKIE['salt'])
		{
			$s = unserialize($_COOKIE['salt']);
			if (isset($s['salt']) && isset($s['items']) && $s['salt'] && $s['items'])
			{
				$salt = $s;
			}
		}

When unserialize() is used on user supplied data it often leads to PHP Object Injection.

Attacker may generate a string of serialized object and parse it to server backend via $_COOKIE['salt'] by submitting a login request. Then func unserialize() will trigger __wakeup() and __destruct() method in serialized obj, resulting in code execution.

Please check other places where the function unserialize() is used.

[ghost]

@Xyntax, thanks for pointing out! Shifted to json format.