Xananasx7

A PHP object injection issue exists in the `jsonOrUnserialize()` function within `functions.lib.php`. The problem occurs when `json decode()` fails, leading the system to call `unserialize()` without class restrictions. Attackers who can write stored extrafields, export configurations, or blocked log entries can inject serialized objects to trigger gadget chains, potentially resulting in remote code execution or unauthorized file manipulation.

PHP Object Injection occurs due to insecure deserialization within the Permission, Cache, and Search components. These components use the `unserialize()` function on stored data without restricting allowed classes. An unauthenticated attacker can trigger arbitrary PHP object instantiation if a malicious serialized payload is placed in the database, which may lead to remote code execution. This process requires the attacker to have high privileges to write the malicious serialized data to the relevant store.

PHP Object Injection occurs due to the use of `unserialize()` calls within the Workflow, Form block, and File/Set components that do not implement the `allowed classes` restriction. This allows an unauthenticated attacker to trigger arbitrary PHP object instantiation if a malicious serialized payload is present in the database.