Taoguang Chen

Hide one's light under a bushel.

[Taoguang Chen @chtg57]

PHP Session Data Injection

2015: Doc bug
2026: CVE-2026-115560

https://t.co/QHQb1YBh2S

[Taoguang Chen @chtg57]

@cyberguru007 Yep and PHP 5/7 still has a lot of unfixed unserialize bugs reported by me.

[Taoguang Chen @chtg57]

The ibb-php program has been shut down indefinitely.

[Taoguang Chen @chtg57]

@hanno Phpbb&Mybb had similar vulnerabilities in early versions. For example, bypass the globals registration defense function.

[Taoguang Chen @chtg57]

@i0n1c Phpbb&Mybb had similar vulnerabilities in early versions. For example, bypass the globals registration defense function.

[Taoguang Chen @chtg57]

I haven’t seen the ibb-php pay bounty for new vulnerabilities more than a year. So maybe ibb-php is dead or PHP is more secure.

[Taoguang Chen @chtg57]

@Hacker0x01 Is the ibb-php project alive?

[Taoguang Chen @chtg57]

@i0n1c I always thought you were the first :-D

[Taoguang Chen @chtg57]

The latest PHP solved a null pinter dereference issue in session upload progress reported by me. https://t.co/YuV5idx0qa But how long will PHP take to solve the serializer handler confusion issue in session upload progress. https://t.co/QHQb1Yj7OK

[Taoguang Chen @chtg57]

@nikita_ppv Some bugs that only against PHP7.4 :D

[Taoguang Chen @chtg57]

The PHP security researchers can’t always lie on the previous credits.

[Taoguang Chen @chtg57]

Object injection via phar file, is it a new PHP exploitation technique? It is a joke! :D:D:D

[Taoguang Chen @chtg57]

@seanhn @nikita_ppv Fuzzing is helpful but not everting, I don’t think they will remake a decision. History of security bugs in unserialize is over.

[Taoguang Chen @chtg57]

@nikita_ppv I think you need also starts a thread regarding phar files parsing.

[Taoguang Chen @chtg57]

@mindplaydk @nikita_ppv PHP module.

[Taoguang Chen @chtg57]

@nikita_ppv The phar/msgpack/ymal etc always use unserialize internally.

[Taoguang Chen @chtg57]

@nikita_ppv https://t.co/4zYH15bgeY

[Taoguang Chen @chtg57]

@nikita_ppv https://t.co/QHQb1Yj7OK

[Taoguang Chen @chtg57]

2004~2017, history of vulnerabilities in PHP’s unserialize is over. @i0n1c

[Taoguang Chen @chtg57]

PHP’s some functions or extensions always use unserialize internally.