Anas Mawlawi

**Name of the Vulnerable Software and Affected Versions** Flag attendance field versions 0.0.0 through 1.2 **Description** An Object Injection issue exists in the Flag attendance field module due to the improper control of modification of dynamically-determined object attributes. The module stores data as PHP-serialized strings, and if malicious data is written directly to the field, it can lead to object injection during the unserialization process. This occurs when an attacker has permission to edit a content entity with an attached `flag attendance field` field and the core JSON:API module is enabled with the option to accept all create, read, update, and delete operations, or if the attacker has another method to edit field values directly. **Recommendations** Update Flag attendance field to a version later than 1.2. Restrict permissions to edit content entities containing the `flag attendance field` field. Disable the option to accept all JSON:API create, read, update, and delete operations in the core JSON:API module.