Two locations call PHP's native unserialize() on data retrieved from the database without the allowed_classes: false safety option:
File: public/main/inc/lib/career.lib.php — Line 495
$userResult = unserialize($careerData['extra_data']);
File: public/main/cron/import_csv.php — Line 2768
$userResult = unserialize($userCareerData['extra_data']);
The extra_data column is populated from user_career records. If an attacker can write crafted serialized PHP objects into this column (e.g., via a secondary SQL injection, a compromised admin CSV import, or a lower-privilege admin panel), they can instantiate arbitrary PHP objects and trigger POP gadget chains present in Symfony, Doctrine, or Monolog — all of which are in the autoloader.
The codebase already provides a safe wrapper at public/main/inc/lib/UnserializeApi.php which enforces an allowed-class whitelist. Line 475 of the same file (career.lib.php) correctly uses UnserializeApi::unserialize('career', $item['value']), proving the safe API is available but was not applied consistently.
Impact
Remote Code Execution (RCE). Any attacker who can write to the user_career.extra_data database column (via CSV import, SQL injection, or admin access) can execute arbitrary OS commands as the web server user. This compromises full server confidentiality, integrity, and availability.
Vishal-07-R Reporter
liyander Reporter
Two locations call PHP's native
unserialize()on data retrieved from the database without theallowed_classes: falsesafety option:File:
public/main/inc/lib/career.lib.php— Line 495File:
public/main/cron/import_csv.php— Line 2768The
extra_datacolumn is populated fromuser_careerrecords. If an attacker can write crafted serialized PHP objects into this column (e.g., via a secondary SQL injection, a compromised admin CSV import, or a lower-privilege admin panel), they can instantiate arbitrary PHP objects and trigger POP gadget chains present in Symfony, Doctrine, or Monolog — all of which are in the autoloader.The codebase already provides a safe wrapper at
public/main/inc/lib/UnserializeApi.phpwhich enforces an allowed-class whitelist. Line 475 of the same file (career.lib.php) correctly usesUnserializeApi::unserialize('career', $item['value']), proving the safe API is available but was not applied consistently.Impact
Remote Code Execution (RCE). Any attacker who can write to the
user_career.extra_datadatabase column (via CSV import, SQL injection, or admin access) can execute arbitrary OS commands as the web server user. This compromises full server confidentiality, integrity, and availability.