Description

Unauthenticated PHP Object Injection in Geo Controller <= 8.9.8 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-27T10:16:38.137Z",
  "pubdate": "2026-08-27T10:16:38.137Z",
  "executiveSummary": "The Geo Controller plugin, in all versions up to and including 8.9.8, is susceptible to an Unauthenticated PHP Object Injection vulnerability.\nThis security flaw stems from the insecure handling of user-supplied input that is passed into PHP's unserialize() function without adequate validation or sanitization.\nThe vulnerability allows an unauthenticated remote attacker to inject arbitrary serialized PHP objects into the application, leading to a variety of malicious outcomes.\nSuccessful exploitation can result in PHP Object Injection (POI) attacks, which may facilitate Remote Code Execution (RCE), arbitrary file deletion, or sensitive data exposure depending on the available gadget chains present in the application's environment.\nGiven that the vulnerability does not require authentication, the risk is classified as critical, as it provides a direct vector for full system compromise from an unauthenticated network position.\nExploitation is highly feasible if the attacker can identify and trigger a reachable entry point that passes controlled input to an unserialization routine.",
  "technicalDetails": "The core of this vulnerability lies in the improper use of the PHP unserialize() function within the Geo Controller codebase (<= 8.9.8).\nPHP Object Injection occurs when an attacker-controlled string is processed by the unserialize() function. Because PHP allows the serialization of complex objects, an attacker can craft a malicious serialized payload that represents an existing class within the application context.\nWhen the application deserializes this object, it triggers PHP magic methods such as __wakeup(), __destruct(), or __toString() if they are defined within the class structure.\nAn attacker can leverage these magic methods to initiate a 'gadget chain'—a sequence of code execution paths already present in the application—to achieve unintended actions.\nThe attack flow proceeds as follows: First, the attacker identifies a public endpoint in the Geo Controller that accepts input which is subsequently passed to an unserialize() function without verification. Second, the attacker performs static analysis on the application to identify classes with useful magic methods (gadgets) that, when instantiated or destroyed, perform operations like file system access, database queries, or command execution.\nThird, the attacker crafts a malicious serialized payload containing the targeted object state. Finally, the attacker transmits this payload to the vulnerable endpoint.\nUpon receipt, the application deserializes the malicious object. The PHP engine instantiates the object based on the payload, immediately invoking the associated magic methods. If the gadget chain is successful, the attacker can achieve Remote Code Execution (RCE) by manipulating variables that influence the control flow, such as modifying execution paths to include malicious files, manipulating database queries to extract sensitive credentials, or overriding system configurations.\nBecause the vulnerability is unauthenticated, the attack surface is exposed to any network actor capable of reaching the Geo Controller's endpoint, requiring no prior system knowledge or legitimate access to the platform.\nThe impact is severe, as the successful execution of a sophisticated gadget chain can bypass typical application-level security controls, leading to total server compromise, data exfiltration, and persistence within the host environment."
}