CyberRota Analysis
AI-GeneratedVersions 6.7.8 to 7.2.5 of b2evolution CMS are vulnerable due to an incomplete fix that allows unauthenticated attackers to submit malicious serialized PHP objects, bypassing validation checks. This flaw can lead to the instantiation of arbitrary PHP objects, potentially enabling remote code execution if exploited. Organizations using affected versions should prioritize patching this vulnerability to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
b2evolution CMS versions 6.7.8 through 7.2.5 contain an incomplete fix for CVE-2016-8901 where the serialized-array object check in param_check_serialized_array() fails to reject payloads with negative integer array keys. Unauthenticated attackers can submit crafted serialized PHP objects via POST requests to htsrv/call_plugin.php that bypass validation and reach unserialize(), instantiating arbitrary PHP objects with attacker-chosen properties that may enable code execution if suitable POP gadget chains exist.