Vulnerability · Published Dec 10, 2023 · Assigned by VulDB

CVE-2023-6654PHPEMS Session Data session.cls.php deserialization

Medium 6.3

In plain English

A medium-severity unsafe deserialization in PHPEMS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.7% (higher than 77% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)1.7%top 23.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

A vulnerability classified as critical was found in PHPEMS 6.x/7.x/8.x/9.0. Affected by this vulnerability is an unknown functionality in the library lib/session.cls.php of the component Session Data Handler. The manipulation leads to deserialization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-247357 was assigned to this vulnerability.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	phpems/phpems	no fix listed	GHSA-5rv2-vvmf-f7w8

Affected products (as reported)

Vendor	Product	Versions
n/a	PHPEMS	6.x7.x8.x9.0

Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

References

https://vuldb.com/?id.247357 vdb-entry, technical-description
https://vuldb.com/?ctiid.247357 signature, permissions-required
https://note.zhaoj.in/share/jw4Hp9cq7T69 broken-link, exploit