UNA CMS PHP Object Injection Vulnerability in BxBaseMenuSetAclLevel.php

A PHP object injection vulnerability has been identified in UNA CMS versions 9.0.0-RC1 prior to 14.0.0-RC4. The issue arises in the BxBaseMenuSetAclLevel.php file, where the profile_id POST parameter is passed to the PHP unserialize() function without proper sanitization. This vulnerability allows remote, unauthenticated attackers to inject arbitrary PHP objects, which could be exploited to execute arbitrary PHP code on the server.

Impact

Exploitation of this vulnerability allows for PHP object injection, which can be used to execute arbitrary PHP code on the server.

Reproduction

To reproduce this vulnerability, send a POST request to the 'menu.php' endpoint with the 'profile_id' parameter containing a serialized object that, when unserialized, could be used to execute arbitrary PHP code. The 'level_id' parameter must also be included in the request.

Remediation

Users are advised to upgrade to UNA CMS version 14.0.0-RC5 or later.