Lab: Arbitrary object injection in PHP
Summary: This PortSwigger lab uses a serialization-based session mechanism that is vulnerable to arbitrary object injection. To solve it, participants must obtain source code access, craft a malicious serialized CustomTemplate object with the lock_file_path attribute set to /home/carlos/morale.txt, and inject it to delete that file.
Key Takeaway: The exercise shows that a session cookie carrying serialized PHP objects can be turned into a file-deletion primitive against a path like /home/carlos/morale.txt, so any application that deserializes user-controlled session data is handing attackers a direct route to server-side file operations.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026