Description

Unauthenticated PHP Object Injection in FreightCo <= 1.1.15 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-24T12:16:53.580Z",
  "pubdate": "2026-08-24T12:16:53.580Z",
  "executiveSummary": "An unauthenticated PHP Object Injection vulnerability has been identified in FreightCo versions 1.1.15 and prior. This security flaw arises from the insecure handling and deserialization of untrusted user input within the application codebase. An unauthenticated remote attacker can exploit this vulnerability by supplying a maliciously crafted serialized payload to the vulnerable endpoint, leading to severe security implications.\nThe primary risk associated with this vulnerability is the potential for Remote Code Execution (RCE), arbitrary file manipulation, or unauthorized data access, depending on the presence of suitable gadget chains within the application environment or its underlying third-party libraries. Successful exploitation allows an attacker to bypass authentication boundaries entirely and execute arbitrary code within the context of the web server user.\nThe attack requires network access to the vulnerable FreightCo instance, but does not necessitate any prior authentication or specific privileges, lowering the complexity of exploitation. Organizations utilizing affected versions of FreightCo face significant risk, as automated threat actors can readily leverage unauthenticated object injection vectors to achieve full system compromise.",
  "technicalDetails": "The vulnerability stems from the improper implementation of native PHP deserialization functions, specifically functions such as unserialize(), operating on untrusted data derived from HTTP requests without adequate sanitization, validation, or cryptographic integrity verification. In PHP applications, when user-supplied input is directly passed to the unserialize() function, the PHP runtime automatically instantiates objects of specified classes and invokes magic methods such as __wakeup() or __destruct().\nThe vulnerable component resides within the request handling logic of FreightCo versions <= 1.1.15, where input parameters or cookies containing serialized data are processed without restriction. The attack flow commences when an unauthenticated remote attacker crafts a specialized exploit payload containing serialized object structures designed to leverage existing application or library classes, commonly referred to as gadget chains.\nUpon transmission of the HTTP request containing the malicious payload to the exposed network service, the application reads the input and executes the insecure deserialization routine. The PHP interpreter reconstructs the serialized objects, immediately triggering the associated magic methods defined within the gadget classes. If the gadget chain is successfully constructed, the execution flow is hijacked to perform unauthorized operations, such as invoking system commands, writing arbitrary files to the web root, or querying sensitive internal resources.\nNetwork exposure is absolute for internet-facing deployments of the affected product, and the vulnerability can be exploited over standard HTTP or HTTPS protocols. Because the flaw is unauthenticated and requires no privileges, any remote user capable of reaching the vulnerable endpoint can initiate the attack sequence. Post-exploitation impact typically includes full application compromise, lateral movement within the internal network, exfiltration of sensitive database contents, and establishment of persistent unauthorized access via webshell deployment."
}