Slackero phpwcms Feedimport Module Deserialization Vulnerability

A critical deserialization vulnerability has been identified in Slackero phpwcms versions through 1.9.45 and 1.10.8. The issue resides in the Feedimport Module, specifically within the file processing.inc.php. The vulnerability is triggered by manipulating the cnt_text argument, allowing for the deserialization of untrusted data without proper validation. This flaw can be exploited remotely, potentially leading to unauthorized actions or access.

Impact

Exploitation of this vulnerability allows for deserialization of untrusted data, which can be manipulated to execute arbitrary code or cause other unintended behavior in the application.

Reproduction

The vulnerability can be reproduced by sending a request to the processing.inc.php file of the Feedimport Module, including a crafted cnt_text argument that exploits the deserialization flaw. This can be done manually or automated with a proof-of-concept exploit available on GitHub.

Remediation

Users are advised to upgrade to phpwcms versions 1.9.46 or 1.10.9.