Slackero phpwcms Deserialization Vulnerability in Custom Source Tab Component

A critical deserialization vulnerability has been identified in Slackero phpwcms versions through 1.9.45 and 1.10.8. The issue arises in the Custom Source Tab component, specifically within the 'cnt21.readform.inc.php' file, where the 'file_get_contents' and 'is_file' functions are misused. The vulnerability can be exploited remotely by manipulating the 'cpage_custom' argument.

Impact

Exploitation of this vulnerability allows for deserialization, which could lead to arbitrary code execution or other malicious actions, depending on the deserialized data and the application's context.

Remediation

Users are advised to upgrade to phpwcms versions 1.9.46 or 1.10.9. Instructions for downloading these versions are available on the Slackero phpwcms GitHub Releases page.