Cotonti Comments Plugin Unserialize() Vulnerability: Early Warning
- Severity
- CRITICAL
- CVSS
- 9.8
- Affected component
- cotonti comments plugin (packagist)
- Affected versions
- >= 1.0.0, <= 1.0.0
- Patched version
- Not yet available
An early warning has been issued for a critical vulnerability in the Cotonti Comments plugin. This vulnerability allows unauthenticated attackers to instantiate arbitrary PHP classes.
What happened
The Cotonti Comments plugin reportedly passes the ci GET parameter to unserialize() without allowed_classes restriction. This allows unauthenticated attackers to instantiate arbitrary PHP classes with attacker-controlled properties. Attackers can exploit PHP object injection through crafted serialized payloads to trigger gadget chains and achieve database manipulation or code execution. The vulnerability affects versions 1.0.0 of the plugin.
To assess your exposure, check if your system uses the Cotonti Comments plugin version 1.0.0. If so, you are potentially vulnerable to this critical issue.
What to do about it
- Upgrade to a version of the Cotonti Comments plugin that fixes the unserialize() vulnerability if available.
- If no fix is available, remove the Cotonti Comments plugin from your system.
- Monitor the provided sources for updates on a patched version.
- Ensure that your system is not exposed to untrusted input that could be used to exploit this vulnerability.
How 0Day would have caught this
cotonti comments plugin is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are potentially affected if you are using version 1.0.0 of the Cotonti Comments plugin.
What should I do right now?
Upgrade to a fixed version of the plugin if available, or remove the plugin if no fix is available.
Is there a patched version available?
No official fix has been published yet. Monitor the sources for updates.
How severe is this vulnerability?
The vulnerability is rated as CRITICAL with a CVSS score of 9.8.