0dd - The Zero (0) Day Division

The Zero (0) Day Division is a group of security professionals working towards a common goal; securing open-source projects.

UBilling PHP Objection Injection

The Issue

PHP Object Deserialization Injection attacks utilise the unserialize function within PHP. The deserialisation of the PHP object can trigger certain methods within the object, allowing the attacker to perform unauthorised actions like execution of code, disclosure of information, etc.

The UBilling project overly trusted user input when processing the data obtained from a form.

Where the Issue Occurred

Displayed below is the code within the UBilling project containing the vulnerable code (Ubilling/modules/general/userreg/index.php#L64):

$newuser_data = unserialize(base64_decode($_POST['repostdata']));

Disclosure Timeline

  • Issue Reported: 29th September 2018
  • Blog Post Published: 28th October 2018
  • Applied for CVE: