Lab: Modifying serialized data types
Summary: This PortSwigger lab uses a serialization-based session mechanism that is vulnerable to authentication bypass, and solving it requires editing the serialized object in the session cookie to reach the administrator account and then deleting the user carlos. The exploit relies on a quirk in how PHP compares data of different types, with behavior that differs between versions and the lab assuming PHP 7.x and earlier.
What's compelling: A session cookie that carries a serialized object is trusted input, and a PHP type-comparison quirk is enough to turn a low-privilege login like wiener:peter into the administrator account - the same class of flaw that lets an attacker delete or take over other users.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026