Executive brief
b2evolution is a content management system used to publish and manage websites. A vulnerability in how it validates serialized data allows attackers to bypass security checks and inject malicious PHP objects without authentication, potentially leading to unauthorized code execution or data theft on affected servers.
Technical details
The vulnerability is a PHP object injection (CWE-502) caused by an incomplete fix to CVE-2016-8901 in the param_check_serialized_array() function located in _core/model/dataobjects/dataobject.class.php. The function fails to properly reject serialized arrays with negative integer keys, allowing attackers to bypass the sanitization logic. Unauthenticated attackers can submit crafted serialized PHP objects via POST requests to htsrv/call_plugin.php; these payloads reach the unserialize() function and instantiate arbitrary objects with attacker-controlled properties. Successful exploitation depends on the availability of suitable POP (Property-Oriented Programming) gadget chains in the application, which could enable remote code execution. The product has been unmaintained since 2024, and no patch is expected.
Affected products
- b2evolution CMS 6.7.8 through 7.2.5
Timeline
- 2026-09-17: disclosed
- 2026-09-13: advisory: GitHub gist published with technical details