Description

b2evolution CMS versions 6.7.8 through 7.2.5 contain an incomplete fix for CVE-2016-8901 where the serialized-array object check in param_check_serialized_array() fails to reject payloads with negative integer array keys. Unauthenticated attackers can submit crafted serialized PHP objects via POST requests to htsrv/call_plugin.php that bypass validation and reach unserialize(), instantiating arbitrary PHP objects with attacker-chosen properties that may enable code execution if suitable POP gadget chains exist.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-09-17T16:17:42.270Z",
  "pubdate": "2026-09-17T16:17:42.270Z",
  "executiveSummary": "This vulnerability involves an insecure deserialization flaw in b2evolution CMS versions 6.7.8 through 7.2.5, resulting from an incomplete mitigation for CVE-2016-8901.\nThe vulnerability manifests within the param_check_serialized_array() function, which fails to adequately sanitize serialized PHP arrays containing negative integer keys.\nUnauthenticated remote attackers can leverage this validation failure to bypass security controls and reach the underlying unserialize() function.\nSuccessful exploitation allows for the instantiation of arbitrary PHP objects with attacker-controlled properties, commonly referred to as PHP Object Injection (POI).\nIf the application environment contains suitable Property-Oriented Programming (POP) gadget chains, this vulnerability can lead to critical security outcomes, including remote code execution, unauthorized file system access, or privilege escalation.\nThe attack is performed via POST requests targeting htsrv/call_plugin.php, requiring no prior authentication or administrative privileges, thus posing a significant risk to affected installations.",
  "technicalDetails": "The core issue originates from an ineffective security patch intended to address CVE-2016-8901. The function param_check_serialized_array(), which is responsible for validating serialized input before processing, performs insufficient checking on serialized-array object structures.\nSpecifically, the validation logic fails to reject serialized arrays that utilize negative integers as keys. By crafting a serialized payload containing these specific malformed keys, an attacker can bypass the intended verification constraints.\nOnce the validation layer is bypassed, the crafted serialized data is passed to the native PHP unserialize() function. This transition from validated input to the execution of unserialize() is the primary trigger for the vulnerability.\nThe attack flow begins when an attacker sends a malicious POST request to the htsrv/call_plugin.php endpoint. The request body contains a serialized PHP object payload specifically designed to manipulate the application's object state.\nWhen unserialize() processes this payload, it instantiates arbitrary objects within the PHP application memory space. By controlling the properties of these instantiated objects, the attacker can influence the application's logic during the object's lifecycle—specifically during magic methods such as __destruct(), __wakeup(), or __toString().\nIf the b2evolution codebase or its included plugins contain classes with these magic methods that perform dangerous operations—such as file manipulation, database queries, or command execution—the attacker can chain these behaviors together into a POP gadget chain.\nThe impact of this vulnerability is contingent upon the availability of these gadgets. If a valid gadget chain is identified, the attacker can achieve remote code execution (RCE) with the privileges of the web server user. Because the endpoint htsrv/call_plugin.php is publicly accessible, the attack vector requires no network-layer restrictions or authentication, allowing for fully remote exploitation.\nThe vulnerability affects all b2evolution CMS versions ranging from 6.7.8 through 7.2.5. The root cause is categorized as an incomplete implementation of a security constraint (CWE-184) leading to insecure deserialization (CWE-502)."
}