PHP Object Injection

Revision as of 22:19, 5 December 2012 by Egidio Romano (talk | contribs)

Jump to: navigation, search

This is a Vulnerability. To view all vulnerabilities, please see the Vulnerability Category page.


Last revision (mm/dd/yy): 12/5/2012

Vulnerabilities Table of Contents


PHP Object Injection is an application level vulnerability which allows an attacker to perform different kinds of malicious attacks. The vulnerability occurs when user-supplied input is not properly sanitized before being used in call to the unserialize() PHP function. Since PHP allows object serialization, attackers could pass ad-hoc serialized strings to a vulnerable unserialize() function resulting in an arbitrary PHP object(s) injection into the application scope.

In order to successfully exploit a PHP Object Injection vulnerability two conditions must be satisfied:

  • The application must have a class which implements a PHP magic method (such as __wakeup or __destruct) that can be abused to conduct malicious attacks.
  • That exploitable class must be declared when the vulnerable unserialize() is being called, otherwise object autoloading must be supported for that class.

Risk Factors

  • The impact of this vulnerability could be High but the likelihood is low. So, the severity of this type of vulnerability is Medium.
  • This vulnerability can make the website vulnerable to some other types of attacks such as Path Traversal, SQL Injection or Code Injection.


The example below shows a PHP class with an exploitable __destruct method:


class VulnCache
   public $cache_file;
   public $cache_data;

   function __construct()
      // some PHP code...

   function __destruct()
      file_put_contents($this->cache_file, $this->cache_data);

// some PHP code...

$user_data = unserialize($_GET['data']);

// some PHP code...


In this example an attacker might be able to create a new PHP file with arbitrary code, requesting the following URL:


Related Vulnerabilities

Related Controls


Do not use unserialize() function with user-supplied input, use JSON functions instead.