Threats tagged 'ghsa-9369-69wj-7m2f'

YesWiki versions prior to 4.6.6 contain an authenticated PHP object injection vulnerability in the BazarImportAction component. The vulnerability arises from unsafe use of unserialize() on attacker-controlled input without restricting allowed classes, combined with automatic invocation of __toString magic methods. This allows authenticated wiki admins to execute arbitrary PHP object deserialization, potentially leading to remote code execution via known gadget chains in included dependencies. The import action lacks CSRF protection, enabling remote attackers to exploit the vulnerability through crafted POST requests that trigger the unserialize sink. No official patch information is provided in the advisory.