November 27, 2020 at 02:13PM

■■■□□ Gadget chain for deserialization in Zend Framework applications. Triggers on __destruct(), gives RCE and works in PHP 7.

https://gist.github.com/YDyachenko/6f60709ce0fc346d0cc0252e07c6aa38

https://t.me/cKure/6144

Rating (of articles):
●○○○○ = Ignorable
●●○○○ = Average
●●●○○ = Good
●●●●○ = Very Good
●●●●● = Excellent
None  = Top-Class

 i@ckure.esy.es