blob: 2ac4ef6626db728f284b7ace7e2ccfa8cd4cf666 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
|
--TEST--
Bug #70513: GMP Deserialization Type Confusion Vulnerability
--SKIPIF--
<?php if (!extension_loaded('gmp')) die('skip requires gmp');
--FILE--
<?php
class obj
{
var $ryat;
function __wakeup()
{
$this->ryat = 1;
}
}
$obj = new stdClass;
$obj->aa = 1;
$obj->bb = 2;
$inner = 's:1:"1";a:3:{s:2:"aa";s:2:"hi";s:2:"bb";s:2:"hi";i:0;O:3:"obj":1:{s:4:"ryat";R:2;}}';
$exploit = 'a:1:{i:0;C:3:"GMP":'.strlen($inner).':{'.$inner.'}}';
$x = unserialize($exploit);
var_dump($x);
var_dump($obj);
?>
--EXPECT--
array(1) {
[0]=>
int(1)
}
object(stdClass)#1 (2) {
["aa"]=>
int(1)
["bb"]=>
int(2)
}
|
