Lab: Developing a custom gadget chain for PHP deserialization
Summary: This PortSwigger lab presents a PHP application that uses a serialization-based session mechanism, which can be exploited through insecure deserialization by deploying a custom gadget chain to achieve remote code execution. The chain works by passing a CustomTemplate object so that the Product constructor fetches default_desc_type from a DefaultMap object, and since that attribute is absent, the __get() method invokes the exec() callback on the attacker-supplied shell command.
Why it matters: The exploit requires only a crafted serialized object passed through the session cookie, so a single user-controlled cookie value is enough to run commands such as deleting a file in another user's home directory.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026