Description

Unauthenticated PHP Object Injection in Advice <= 1.18.0 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-06T15:17:19.313Z",
  "pubdate": "2026-08-06T15:17:19.313Z",
  "executiveSummary": "An unauthenticated PHP Object Injection vulnerability has been identified in the Advice product affecting versions 1.18.0 and below. This security flaw enables remote attackers to supply malicious serialized data to the application without requiring any prior authentication or privileges. The primary impact of this vulnerability stems from the insecure deserialization of untrusted input within the vulnerable codebase. If successfully exploited, an adversary can manipulate object properties during the deserialization process, potentially leading to severe security consequences such as arbitrary code execution, unauthorized data access, file manipulation, or complete system compromise depending on the presence of compatible gadget chains within the application context. The risk implications are critical due to the lack of authentication requirements and the remote network exposure of the attack surface. Exploitation relies on the application instantiating classes with attacker-controlled data, bypassing standard input validation mechanisms and directly interacting with underlying PHP magic methods to trigger unintended code execution paths.",
  "technicalDetails": "The vulnerability exists in Advice versions 1.18.0 and below, specifically within components that handle the deserialization of user-supplied data without adequate sanitization or validation. The root cause of the flaw is the insecure usage of PHP native deserialization functions, such as unserialize(), on input derived from HTTP requests without verifying the integrity or origin of the data payload. Attackers can interact with the vulnerable endpoint over the network by transmitting a custom-crafted serialized PHP object. Because no authentication or privilege requirements are mandated by the vulnerable component, any unauthenticated remote user can initiate the attack flow.\nThe step-by-step attack flow proceeds as follows: First, the attacker identifies the exposed endpoint or function responsible for processing serialized data within the Advice application. Second, the attacker constructs a malicious serialized payload containing specific class definitions and properties designed to leverage available gadget chains present in the application or its included third-party libraries. Third, the attacker transmits this payload via an HTTP request to the vulnerable target. Fourth, upon receiving the input, the application passes the untrusted data directly to the vulnerable unserialize() function. Fifth, during the object instantiation phase, PHP automatically invokes magic methods such as __wakeup() or __destruct() within the provided classes. If the crafted payload successfully interacts with these magic methods and leverages existing gadget chains, the application executes the attacker's unintended control flow logic.\nThe post-exploitation impact includes the potential for remote code execution, file system read and write operations, or server-side request forgery, contingent upon the specific gadget chains available in the application environment. Network exposure is broad as the vulnerability is reachable over standard web protocols without session tokens or API keys. Remediation requires identifying all instances where untrusted data is deserialized and replacing insecure functions with safer alternatives such as JSON encoding and decoding."
}