Description

Unauthenticated PHP Object Injection in Agricola <= 1.21.0 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-06T15:17:19.560Z",
  "pubdate": "2026-08-06T15:17:19.560Z",
  "executiveSummary": "An unauthenticated PHP Object Injection vulnerability has been identified in the Agricola product affecting versions <= 1.21.0. This security flaw arises from the insecure handling and deserialization of user-supplied data without adequate sanitization or validation controls.\nThe vulnerability allows remote, unauthenticated threat actors to supply malicious serialized object payloads directly to the application. Successful exploitation of this flaw can lead to severe security implications, including arbitrary code execution, unauthorized data access, file deletion, or complete system compromise, depending on the availability of suitable gadget chains within the application context.\nGiven that the attack vector requires no prior authentication or elevated privileges, any internet-exposed instance running vulnerable versions of Agricola is at immediate risk. Mitigation requires updating the affected product to a patched version once available or implementing strict input validation and disabling insecure deserialization methods.",
  "technicalDetails": "The root cause of the vulnerability resides in the insecure deserialization mechanism implemented within Agricola <= 1.21.0. Specifically, the application processes user-controllable input via PHP's native deserialization functions, such as unserialize(), without properly validating the structure or origin of the data before instantiation.\nPHP Object Injection occurs when untrusted user input is passed into the unserialize() function. In the context of Agricola, an unauthenticated attacker can interact with vulnerable endpoints exposed over the network, crafting a malicious serialized payload containing specific property configurations of existing classes defined within the application scope or its imported third-party libraries.\nThe attack flow proceeds as follows: First, the attacker identifies an input vector that accepts serialized data processed by the vulnerable component. Second, the attacker crafts a serialized payload designed to leverage magic methods (such as __wakeup() or __destruct()) present in available gadget chains. Third, the attacker transmits this payload to the target via standard network protocols (HTTP/HTTPS). Fourth, upon receiving the input, the application automatically invokes unserialize() on the malicious string. Finally, the execution of the deserialized object triggers the embedded magic methods, leading to secondary exploitation impacts such as remote code execution, SQL injection, or server-side request forgery.\nThe vulnerable component is the data handling routine responsible for processing serialized parameters within Agricola <= 1.21.0. Exploitation requires network access to the target application, requires zero privileges, and bypasses all authentication mechanisms entirely due to the unauthenticated nature of the vulnerable entry point. Post-exploitation impact heavily depends on the presence of functional gadget chains in the application environment, potentially granting the attacker complete control over the underlying operating system hosting the vulnerable web application."
}