PHP Object Injection
PHP Object Injection is a vulnerability in web applications that arises when user-supplied data is not adequately processed or validated before being utilized in the process of deserializing objects in PHP. This vulnerability allows an attacker to manipulate serialized objects, potentially leading to the execution of arbitrary code on the server.
PHP Object Injection (POI) is a vulnerability in web applications that arises due to improper handling of user-supplied data passed in a serialized form. To understand PHP Object Injection, it’s helpful to grasp some basics:
Object Serialization:
In PHP, objects can be converted into a string using a process called serialization. This enables the storage or transmission of objects between different parts of an application.
Vulnerability during Deserialization:
The vulnerability occurs when an application deserializes data coming from an untrusted source, such as user input. An attacker can manipulate serialized data by injecting malicious code or objects.
Potential Attacks:
Attacks using PHP Object Injection can lead to the execution of arbitrary code on the server. An attacker may create or modify objects in a way that performs malicious actions, such as reading or writing files, interacting with a database, and even gaining remote access.
<?php
class LoggingClass {
function __construct($filename, $content) {
// add .log to the filename so we are really creating a log file!!
$this->filename = $filename . ".log";
$this->content = $content;
}
// This method is executed for each object at the end of the PHP execution
function __destruct() {
// flush the logs
file_put_contents($this->filename, $this->content);
}
}
$data = unserialize($_GET['data']);
Scanners that detect vulnerability
OWASP ZAP (Zed Attack Proxy): OWASP ZAP is a free and open-source security testing tool for web applications.
Burp Suite: Burp Suite is a popular tool for web application security testing.
Acunetix: Acunetix provides functionality for detecting and addressing vulnerabilities in web applications, including PHP Object Injection.
Netsparker: Netsparker is an automated tool for discovering vulnerabilities in web applications.
AppSpider: AppSpider provides tools for automated web application security testing.
Nxposee: Nexpose is a tool for scanning and analyzing the security of web applications.
Nmap: Nmap is a utility for discovering devices and analyzing network services, also used for security testing.
Average CVSS score for PHP Object Injection
The Common Vulnerability Scoring System (CVSS) is a framework for assessing the severity of vulnerabilities, assigning scores to help prioritize responses to security threats. The CVSS score ranges from 0 to 10, with a higher score indicating a more severe vulnerability. The average CVSS score for PHP Object Injection vulnerabilities can vary widely based on factors such as the specific implementation, the impact of the vulnerability, and the ease of exploitation.
CWE information
CWE-502: Deserialization of Untrusted Data
CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers (‘HTTP Response Splitting’)
CWE-94: Improper Control of Generation of Code (‘Code Injection’)
PHP Object Injection is a critical security vulnerability that arises when applications unserialize user-provided data without proper validation. This vulnerability can lead to the execution of arbitrary PHP code, potentially compromising the integrity and security of the application.
Mitigating PHP Object Injection requires a combination of secure coding practices and input validation:
Input Validation:
Validate and sanitize all user input, especially if it involves serialized data.
Avoid accepting serialized PHP objects from untrusted or user-controlled sources.
Whitelisting Classes:
Use whitelists to explicitly define which classes can be unserialized, preventing the instantiation of arbitrary objects.
Alternative Serialization Formats:
Consider using alternative serialization formats like JSON or XML for data interchange instead of serialized PHP objects.
These formats are less prone to security issues and provide a more controlled and predictable structure.
Secure Deserialization Libraries:
If possible, use secure deserialization libraries that provide additional safeguards against object injection.
Some libraries offer features like signature verification to ensure the integrity of serialized data.
Security Audits and Code Reviews:
Conduct regular security audits and code reviews to identify and address potential instances of PHP Object Injection.
Use static analysis tools to automatically detect vulnerabilities in the codebase.
Educate Developers:
Ensure that developers are aware of the risks associated with PHP Object Injection and provide training on secure coding practices.
Encourage a security-aware mindset throughout the development lifecycle.
Update PHP Versions:
Keep PHP versions up-to-date to benefit from security improvements and patches provided by the PHP community.
Other Services
Insomnia Security Scanner
AI-powered web application security scanner by CQR. Automated vulnerability discovery, exploit verification, and detailed reporting for modern applications.
Learn more
Infrastructure Protection by CRYEYE
Security audits via CryEye provide enterprise information security, protecting the entire infrastructure.
Learn more Penetration Testing
Find vulnerabilities across your entire business infrastructure before hackers do! At penetration testing consulting, we will select pentest methods and other custom cybersecurity recommendations for your business.
Learn more Social Engineering
Simulate real-world phishing, vishing, and pretexting attacks to measure and improve your team's security awareness and response capabilities.
Learn more Performance Testing
All kinds of load and performance testing of your system from the CQR online security company.
Learn more AI-Powered Vulnerability Assessment
Leverage artificial intelligence to discover, prioritize, and remediate vulnerabilities across your digital assets faster and more accurately than traditional scanners.
Learn more Cloud Security Audit (AWS / GCP / Azure)
Comprehensive security review of your cloud environments — IAM policies, network controls, data exposure, and misconfigurations across all major cloud platforms.
Learn more DevSecOps Integration
Embed security into every stage of your CI/CD pipeline. Automated SAST, DAST, SCA, and secret scanning so vulnerabilities are caught before they reach production.
Learn more API Security Testing
In-depth testing of REST, GraphQL, and SOAP APIs for authentication flaws, authorization bypasses, injection vulnerabilities, and data leakage risks.
Learn more Mobile Application Penetration Testing
Manual and automated security testing for iOS and Android applications — reverse engineering, runtime analysis, traffic interception, and backend API assessment.
Learn more IoT Security Assessment
Evaluate firmware, communication protocols, cloud backends, and physical interfaces of IoT devices to identify vulnerabilities before attackers do.
Learn more Blockchain & Smart Contract Audit
Formal verification and manual code review of smart contracts on Ethereum, Solana, and other chains. Detect reentrancy, overflow, and logic flaws before deployment.
Learn more Red Team Operations
Advanced adversary simulation using real attacker TTPs (MITRE ATT&CK) to test your detection, response, and overall security posture under realistic conditions.
Learn more Threat Intelligence & Monitoring
Continuous monitoring of threat feeds, dark web, and attacker infrastructure to provide actionable intelligence specific to your organization and industry.
Learn more Zero Trust Architecture Review
Assess and design your Zero Trust security model — identity verification, micro-segmentation, least-privilege access, and continuous validation controls.
Learn more Compliance Consulting (PCI DSS / SOC 2 / GDPR)
Expert guidance to achieve and maintain compliance with major security frameworks. Gap analysis, remediation roadmaps, and audit-readiness support.
Learn more Dark Web Monitoring
Continuous surveillance of dark web forums, marketplaces, and breach databases for leaked credentials, sensitive data, or mentions of your organization.
Learn more Phishing Simulation & Awareness Training
Controlled phishing campaigns combined with interactive security awareness training to build a human firewall across your entire organization.
Learn more Supply Chain Security Audit
Assess third-party vendor risks, open-source dependencies, and software supply chain integrity to prevent attacks like SolarWinds and Log4Shell.
Learn more Container & Kubernetes Security
Security review of Docker images, Kubernetes clusters, RBAC policies, network policies, and runtime configurations to harden your container infrastructure.
Learn more Web Application Firewall (WAF) Deployment
Professional WAF setup, rule tuning, and ongoing management to block SQL injection, XSS, CSRF, and other OWASP Top 10 threats in real time.
Learn more Bug Bounty Program Management
Full lifecycle management of your bug bounty program — scope definition, researcher coordination, triage, validation, and remediation tracking.
Learn more OSINT Investigation Services
Open-source intelligence gathering on individuals, organizations, and infrastructure. Ideal for pre-engagement recon, fraud investigation, and competitive analysis.
Learn more Digital Forensics & Incident Response
Rapid response to security breaches — evidence collection, malware analysis, attacker timeline reconstruction, and actionable remediation recommendations.
Learn more