CVE-2024-54135: Php Unserialize User Input
User-controlled input flows into PHP's unserialize() (often via base64_decode). Calling unserialize() on attacker-controlled data allows instantiation of arbitrary objects whose magic methods (__wakeup, __destruct, __toString, etc.) execute automatically, enabling PHP Object Injection / gadget-chain exploitation (CWE-502). Use json_decode() with json_encode(
greprules fetch cve-2024-54135-php-unserialize-user-input --engine opengrepDescription
User-controlled input flows into PHP's unserialize() (often via base64_decode). Calling unserialize() on attacker-controlled data allows instantiation of arbitrary objects whose magic methods (__wakeup, __destruct, __toString, etc.) execute automatically, enabling PHP Object Injection / gadget-chain exploitation (CWE-502). Use json_decode() with json_encode(
Detection target
Not provided
Recommended fix
Not provided
False-positive notes
Not provided
Community feedback
Sign in to report false positives, mark this rule useful, or suggest metadata improvements.