Save axg11/3e29501c33f6e1e05ac2a00107afd64e to your computer and use it in GitHub Desktop.
b2evolution CMS contains an incomplete fix for CVE-2016-8901. The param_check_serialized_array() function fails to validate negative integer keys in serialized arrays, allowing an attacker to bypass the sanitization and inject arbitrary PHP objects.
Product: b2evolution CMS
Affected versions: All versions including latest (7.2.x)
Component: _core/model/dataobjects/dataobject.class.php — param_check_serialized_array()
CWE-502: Deserialization of Untrusted Data (PHP Object Injection)
Incomplete fix of: CVE-2016-8901
The original CVE-2016-8901 fix added array key validation in param_check_serialized_array() . However, the fix only checks for non-negative integer keys and string keys. By supplying a negative integer key (e.g., -1 ), an attacker bypasses the validation entirely, allowing a malicious serialized PHP object to pass through unsanitized.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
