The vulnerability in Cotonti CMS's Comments plugin arises from deserializing base64-decoded user input without specifying allowed classes, enabling PHP Object Injection (CWE-502). Specifically, the 'ci' POST parameter in CreateAction.php and the 'cb' parameter in EditAction.php are deserialized unsafely. Attackers with write access to comments can craft serialized objects of any loaded class, demonstrated with the MySQL_cache class to trigger a __destruct()->flush() chain that inserts attacker-controlled data into the cot_cache database table. This confirms a practical POP (Property Oriented Programming) chain exploitation. The DeleteAction.php sink is restricted to admins and thus not exploitable by regular members. The vulnerability has a CVSS 3.1 score of 7.6 (high severity) with network attack vector, low attack complexity, privileges required, no user interaction, and high confidentiality impact.

Successful exploitation allows attackers with write access to comments to perform PHP Object Injection, leading to arbitrary object instantiation. This can cause attacker-controlled database inserts and potentially remote code execution depending on the presence of other gadget chains in the Cotonti installation. Confidentiality, integrity, and availability impacts are high, with the ability to insert arbitrary data and possibly execute code. The vulnerability does not require user interaction but does require privileges to write comments (default setting).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict write access to comments to trusted users only and consider disabling the Comments plugin if feasible. Monitor for updates from Cotonti CMS regarding patches or official mitigations. Avoid using unserialize() on untrusted data or apply allowed_classes restrictions to prevent unsafe object instantiation.