Executive brief
Subrion CMS, a content management system used for building websites, contains a critical security flaw in its login process. An attacker can send a specially crafted web request that tricks the system into executing unauthorized code. This could allow a remote attacker to take full control of the website, access sensitive user data, or disrupt operations without needing a password.
Technical details
A PHP Object Injection vulnerability exists in Subrion CMS 4.0.5 within the `includes/classes/ia.core.users.php` file. The application improperly handles user-supplied data by passing the 'salt' cookie directly into the `unserialize()` function during a login request. A remote, unauthenticated attacker can exploit this by providing a crafted serialized object in the cookie. This triggers PHP magic methods such as `__wakeup()` or `__destruct()`, which can be leveraged to achieve arbitrary code execution or unauthorized file manipulation. The issue was addressed in version 4.1.0.
Affected products
- Intelliants Subrion CMS 4.0.5
Timeline
- 2017-01-17: disclosed: Issue reported on GitHub
- 2017-01-20: advisory: NVD published CVE-2017-5543