Threats tagged 'ghsa-m8pm-m9cw-wjqh'

An unsafe deserialization vulnerability exists in MixPHP Framework versions 2.x through 2.2.17. The vulnerability arises from the sync-invoke TCP server component which accepts serialized PHP closures over a TCP socket bound to localhost (127.0.0.1). The server deserializes this data without authentication or signature verification and executes it, allowing an attacker with local TCP access to execute arbitrary code.