UNA CMS Security Flaw: When Your Website’s Safety Goes on a Coffee Break
Attention UNA CMS users: there’s a PHP Object Injection vulnerability lurking in versions up to 14.0.0-RC4. Your website could become a playground for mischievous hackers if they exploit this flaw. So, unless you want your site to become the digital equivalent of a clown car, it’s time to patch things up!
Hot Take:
UNA CMS has a vulnerability that makes it about as secure as a screen door on a submarine! Who knew that a little POST parameter could open the floodgates to remote code execution? This is a classic case of “Oops, I did it again” for web security, showing us that even your CMS can have an existential crisis.
Key Points:
- UNA CMS versions from 9.0.0-RC1 to 14.0.0-RC4 are vulnerable to PHP Object Injection.
- The vulnerability is located in the BxBaseMenuSetAclLevel.php script.
- User input via the “profile_id” POST parameter isn’t properly sanitized.
- Remote attackers can inject arbitrary PHP objects, leading to code execution.
- The exploit requires no authentication—just like a public park, everyone is welcome!
Already a member? Log in here