SEC-UNSERIALIZE-001
unserialize($_POST['data'])
unserialize($_POST) / untrusted input
unserialize on user input is RCE. It “works” on Joomla 6 and is still wrong.
unserialize($_POST['data']) → JSON + validation
Symptoms people search
unserialize post · object injection
Replace this code
Swap unserialize($_POST['data']) for JSON + validation.
Joomla 3
Remove or stop calling this
$data = unserialize($_POST['payload']);Joomla 4 / 6
Use this instead
$data = json_decode($app->getInput()->get('payload', '{}', 'RAW'), true);How to fix it
- 1Use JSON.
- 2Never unserialize request data.
Also known as
unserialize
There is no 1:1 swap for this one. The architecture changed. If you cannot rewrite it, Infyways can.
Related issues
- Joomla 3 → 4PHP
jimport() autoloader calls
jimport('joomla.filesystem.file') → use Joomla\CMS\Filesystem\File;
- Joomla 3 → 4PHP
DS path constant
DS → DIRECTORY_SEPARATOR or /
- Joomla 3 → 4PHP
JPATH_PLATFORM
JPATH_PLATFORM → Do not use — autoload instead
- Joomla 3 → 4Manifest / installer
Updater client 0 / 1 integers
<client>0</client> → site / administrator strings
- Joomla 3 → 4PHP
mysql_* PHP functions
mysql_query() → Joomla DatabaseInterface / mysqli / PDO
- Joomla 3 → 4PHP
each() / create_function() / ereg / split
each($array) → foreach / closures / preg_*