Description

Unauthenticated PHP Object Injection in FundEngine <= 1.7.9 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-18T15:16:52.690Z",
  "pubdate": "2026-08-18T15:16:52.690Z",
  "executiveSummary": "An unauthenticated PHP Object Injection vulnerability has been identified in the FundEngine plugin, affecting all versions up to and including version 1.7.9. This security flaw arises from the insecure handling and deserialization of untrusted user-supplied data by the application, allowing an external actor to inject arbitrary serialized PHP objects into the execution flow.\nThe primary impact of this vulnerability includes potential remote code execution, arbitrary file deletion, or data manipulation, depending on the presence of suitable gadget chains within the application scope or third-party libraries loaded in the environment. Successful exploitation compromises the integrity and confidentiality of the underlying hosting server and application data.\nThe vulnerability affects the FundEngine product across versions <= 1.7.9 and requires no prior authentication or administrative privileges, significantly lowering the attack complexity for malicious actors with network access to the target system. Exploitation prerequisites involve the ability to send crafted HTTP requests containing malicious serialized payloads to vulnerable endpoints that process input insecurely via functions such as unserialize().",
  "technicalDetails": "The vulnerability stems from improper input validation and the unsafe deserialization of untrusted data. Specifically, the vulnerable component within FundEngine processes user input and passes it to PHP's native unserialize() function without adequate sanitization or type checking.\nThe attack flow proceeds as follows: an unauthenticated attacker crafts a malicious serialized PHP object payload designed to leverage existing class definitions and magic methods—such as __wakeup() or __destruct()—within the application or its dependent libraries (commonly referred to as gadget chains). The attacker then transmits this payload over the network via HTTP requests to the vulnerable endpoint handling the input.\nUpon receiving the request, the application attempts to reconstruct the serialized object using unserialize(). During this process, PHP automatically invokes the implemented magic methods of the instantiated classes, executing the attacker-controlled logic embedded within the payload. Depending on the available gadget chains in the application context, this execution flow can lead to severe post-exploitation consequences, including arbitrary code execution, unauthorized database queries, or server-side request forgery (SSRF).\nNetwork exposure is remote, as the vulnerable entry points are accessible over HTTP/HTTPS without requiring authentication or specific user privileges. The affected versions are explicitly FundEngine <= 1.7.9."
}