Bitdefender GravityZone Console PHP Object Injection Vulnerability Allowing Arbitrary Command Execution

A PHP object injection vulnerability has been identified in Bitdefender GravityZone Console versions prior to 6.41.2-1. The issue arises in the 'sendMailFromRemoteSource' method of 'Emails.php', where user-supplied input is unsafely processed using 'php unserialize()' without proper validation. This vulnerability allows attackers to craft malicious serialized payloads that can be used to inject objects, execute arbitrary commands on the host system, and perform unauthorized file writes.

Impact

Exploitation of this vulnerability allows for PHP object injection, arbitrary command execution on the host system, and unauthorized file writes.

Remediation

Users can update to Bitdefender GravityZone Console version 6.41.2-1 to address this vulnerability.