PT-2026-68166 · Cotonti Cms+1 · Comments Plugin+1
CVSS v3.1
7.6
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L |
Name of the Vulnerable Software and Affected Versions
Cotonti CMS (affected versions not specified)
Description
The Comments plugin in Cotonti CMS fails to restrict classes during the deserialization of user-supplied data, leading to a PHP Object Injection. This occurs when the
unserialize() function is used on base64-decoded input without an allowed classes restriction. The issue is present in the following locations:- In
plugins/comments/controllers/actions/CreateAction.php, theciPOST parameter is processed. - In
plugins/comments/controllers/actions/EditAction.php, thecbparameter is processed within theprepareComeBack()function. - In
plugins/comments/controllers/actions/DeleteAction.php, a similar pattern exists but is restricted to administrators.
Members with write access to comments can exploit this to instantiate arbitrary classes loaded by the system. For example, using the
MySQL cache class, an attacker can trigger the destruct()->flush() chain to execute unauthorized INSERT INTO cot cache operations. Depending on the available gadget chains in the installation, this could potentially lead to Remote Code Execution (RCE), which is the ability to execute arbitrary commands on the server.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Deserialization of Untrusted Data
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Comments Plugin
Cotonti Cms