Description

Unauthenticated PHP Object Injection in Agora <= 1.9 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-06T15:17:19.437Z",
  "pubdate": "2026-08-06T15:17:19.437Z",
  "executiveSummary": "An unauthenticated PHP Object Injection vulnerability has been identified in Agora versions <= 1.9.\nThis vulnerability allows unauthenticated remote attackers to supply malicious serialized data to vulnerable application parameters, leading to severe security implications including potential remote code execution, arbitrary file manipulation, or denial of service depending on the available gadget chains within the application context.\nThe flaw stems from insecure deserialization practices where user-supplied input is processed by PHP's unserialize() function without proper validation or sanitization.\nAffected systems include deployments running Agora version 1.9 or earlier.\nSuccessful exploitation requires network access to the target application and does not necessitate any prior authentication or special privileges.\nThe risk associated with this vulnerability is critical, as it compromises the integrity and confidentiality of the host system, potentially granting the attacker complete control over the underlying web server.",
  "technicalDetails": "The vulnerability resides in the Agora application within versions <= 1.9, specifically within components that handle user-supplied data and pass it to PHP's native unserialize() function.\nRoot Cause: The application insecurely handles serialization and deserialization processes by failing to restrict or validate the data being unserialized. When untrusted input is processed by unserialize(), PHP automatically instantiates objects and invokes magic methods (such as __wakeup() or __destruct()) defined within the application or third-party libraries included in the environment.\nAuthentication and Privileges: The vulnerability is unauthenticated, meaning an attacker does not require any valid user session, credentials, or administrative privileges to interact with the vulnerable endpoint.\nNetwork Exposure: The vulnerable parameter or endpoint is accessible over the network via standard HTTP/HTTPS requests, exposing the application to remote exploitation.\nAttack Flow and Exploitation Method: 1. The attacker identifies an entry point in Agora <= 1.9 where user input is accepted and subsequently passed to an insecure deserialization sink. 2. The attacker crafts a malicious serialized payload containing a specific PHP object structure. This structure leverages available gadget chains—classes within the application codebase or included dependencies that possess magic methods performing dangerous operations when triggered. 3. The attacker transmits the crafted payload to the vulnerable endpoint via an HTTP request (e.g., POST or GET parameter). 4. The application receives the payload and executes the unserialize() function on the untrusted data. 5. The PHP runtime reconstructs the object graph, automatically triggering the embedded magic methods. 6. The execution of these magic methods facilitates the attacker's objective, such as executing arbitrary system commands, reading or writing sensitive files, or triggering other secondary vulnerabilities.\nPost-Exploitation Impact: Depending on the privileges of the web server process and the availability of viable gadget chains, successful exploitation can result in complete system compromise, unauthorized data access, code execution, and lateral movement within the network."
}