Description

Unauthenticated PHP Object Injection in FundEngine <= 1.7.9 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-20T12:16:36.690Z",
  "pubdate": "2026-08-20T12:16:36.690Z",
  "executiveSummary": "An unauthenticated PHP Object Injection vulnerability has been identified in the FundEngine product affecting versions 1.7.9 and below.\nThis vulnerability allows remote, unauthenticated attackers to supply maliciously crafted serialized objects to vulnerable application parameters or endpoints.\nSuccessful exploitation of this flaw can lead to severe security implications, potentially enabling remote code execution, arbitrary file deletion, or data manipulation depending on the presence of suitable gadget chains within the application scope or its dependencies.\nThe risk level associated with this vulnerability is critical due to the lack of authentication requirements and the potential for complete system compromise.\nAttackers do not require prior access or privileges within the application to initiate the exploit, relying solely on network connectivity to the target running the vulnerable FundEngine versions.",
  "technicalDetails": "The vulnerability stems from insecure deserialization practices within the FundEngine application, specifically in versions 1.7.9 and below.\nPHP Object Injection occurs when untrusted user-supplied data is passed directly into the unserialize() function without adequate validation or sanitization.\nIn PHP, the unserialize() function converts a serialized string back into a programmatic object. If an attacker can control the input string, they can instantiate arbitrary classes available within the PHP application context.\nThe attack flow begins when an unauthenticated remote attacker identifies an entry point where serialized data is accepted and processed by the application.\nThe attacker crafts a malicious payload containing serialized data that alters the internal state of existing objects or instantiates specific classes designed to trigger unintended behavior.\nWhen the vulnerable component processes the input using unsafe deserialization, PHP automatically invokes magic methods such as __wakeup() or __destruct() defined within the instantiated classes.\nBy leveraging existing classes within the application or third-party libraries (commonly referred to as 'gadget chains'), the attacker can orchestrate a sequence of method calls that lead to secondary vulnerabilities.\nDepending on the available gadget chains, post-exploitation impact may include remote code execution through system command execution functions, arbitrary file read or write operations, or SQL injection.\nThe vulnerability is exposed over the network, requires no user interaction, and does not mandate any authentication or special privileges, making it highly attractive for automated exploitation."
}