Other nomination

HikaShop Object Injection

The Joomla HikaShop extension passed base64-decoded user input straight to unserialize, allowing PHP object injection. Sucuri chains JDatabaseDriverMysqli's destructor into PHPMailer's sendmail path and abuses sendmail's queue and log options to write the outgoing mail, whose subject carries PHP code, into a file under the web root, turning the injection into a backdoor.

Record

Published by

Sucuri Blog

Date

17 November 2014

In the archive

• Nominated for the 2014 Top 10 Web Hacking Techniques

Tags

• deserialization
• gadget-chain
• rce
• php
• joomla
• lfi
• injection
• case-study
• owasp-a01-2021
• owasp-a03-2021
• owasp-a08-2021

This page is the archive's own catalogue record. The research is the work of Sucuri Blog, first published at the original source. Preserved copies are kept so the citation survives its host.