vendor:
PHP
by:
Stefan Esser
7.5
CVSS
HIGH
Session Deserialization Stack Information Leak
200
CWE
Product Name: PHP
Affected Version From: PHP versions with the WDDX extension enabled
Affected Version To: PHP versions with the WDDX extension enabled
Patch Exists: NO
Related CWE:
CPE: a:php:php
Platforms Tested:
2007
PHP WDDX Session Deserialization Stack Information Leak
This PHP code demonstrates a proof of concept for a vulnerability in the WDDX extension of PHP. The vulnerability allows for an information leak through the deserialization of session data. By sending a specially crafted session data, an attacker can retrieve sensitive information from the server's memory stack.
Mitigation:
To mitigate this vulnerability, it is recommended to update PHP to a version that includes the fix for this issue. Additionally, disabling the WDDX extension can also prevent exploitation of this vulnerability.
