Listen to this Post
The vulnerability exists in the cms_rest.php component of SIGB PMB v8.0.1.14. Attackers send crafted HTTP requests with malicious serialized data to this endpoint. The application unserializes user input without proper validation, leading to arbitrary file inclusion. This occurs due to insecure deserialization of PHP objects. By manipulating serialized strings, attackers can trigger magic methods like __wakeup() or __destruct() in vulnerable classes. These methods may execute code paths that include local or remote files. For instance, a payload can force the application to include a web shell from a controlled server. The unserialize() function allows instantiation of objects that call dangerous functions such as file_get_contents() or eval(). This grants arbitrary PHP code execution on the server. Exploitation requires no authentication, making it remotely accessible. The vulnerability leverages a gadget chain within the application’s codebase. Attackers can exfiltrate data, install backdoors, or gain full system control. The arbitrary file inclusion aspect also permits reading sensitive configuration files. This flaw stems from missing input sanitization before deserialization in cms_rest.php.
Platform: SIGB PMB
Version: v8.0.1.14
Vulnerability: Arbitrary code execution
Severity: Critical
Date: 11/25/2025
Prediction: Not disclosed
What Undercode Say:
Analytics
- curl -X POST http://target/cms_rest.php -d “param=O:8:\”BadClass\”:1:{s:3:\”cmd\”;s:10:\”cat /etc/passwd\”;}”
- php -r “class Exploit { public $cmd = ‘id’; } echo serialize(new Exploit());”
- wget –post-data “data=malicious_serialized” target/cms_rest.php
How Exploit:
- Craft serialized payload.
- Send POST request.
- Trigger file inclusion.
- Execute system commands.
Protection from this CVE
- Update software version.
- Validate input data.
- Disable risky functions.
Impact:
- Remote code execution.
- System compromise.
- Data breach.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
