# YesWiki Vulnerable to Authenticated PHP Object Injection in BazarImportAction via unserialize

YesWiki's bazarimport action unserializes base64 POST data without allowed_classes and without CSRF token, letting a forged admin request reach PHP object injection and RCE.

- Payout: Research
- Severity: critical
- Program: YesWiki
- Found by: fg0x0
- Disclosed: 2026-07-09
- CVE: CVE-2026-52777
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-9369-69wj-7m2f
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-9369-69wj-7m2f
- Tags: area:web domain:web impact:privesc impact:rce kind:research platform:ghsa sev:critical tech:php technique:chained technique:source-review vuln:csrf vuln:deserialization vuln:rce

**Target:** PHP web app bazarimport action (CSVManager::importEntry)
**Root cause:** importEntry() calls unserialize(base64_decode($entry)) on attacker-controlled $_POST['importfiche'] without allowed_classes=false, and the importentries mode lacks a CSRF token check, so a forged admin request reaches the sink.
**Steps:**
1. Reach the default BazaR page: `?BazaR&vue=importer&id_typeannonce=1` routes to BazarAction -> callAction('bazarimport').
2. Confirm the importentries branch skips CsrfTokenController::checkToken (no csrf reference in BazarImportAction.php).
3. Craft payload: `importfiche[0]=<base64(serialized PHPGGC Doctrine/FW1 or RCE1 chain)>`.
4. Deliver auto-POSTing HTML to a logged-in wiki admin; session cookie passes checkSecuredACL.
5. unserialize fires, instantiating attacker classes; array_map('strval') additionally triggers __toString on elements.
6. Swap in a real PHPGGC Doctrine chain to obtain system() or file_put_contents() for shell.
**How found:** Code review of the bazar import path: noticed unserialize without allowed_classes in CSVManager::importEntry, traced $_POST['importfiche'] to the sink, then grepped BazarImportAction.php for csrf/checkToken and found the asymmetry with FormController's checkToken usage, establishing the CSRF-to-object-injection chain.
**Exploitation:** Attacker identifies an admin, sends an HTML page that auto-POSTs importfiche[0]=<base64 PHPGGC payload> to /?BazaR&vue=importer&id_typeannonce=1; the admin's cookie satisfies checkSecuredACL, no CSRF token is required, and unserialize instantiates the gadget chain (Doctrine/RCE1 -> system, Doctrine/FW1 -> file_put_contents) yielding OS command execution or a web shell on the host.
**Escalation:** From wiki admin content control to OS shell: write web shells, read wakka.config.php, dump MySQL, pivot to co-hosted sites.
**Insight:** When a sink needs admin privileges, grep sibling controllers for checkToken to find state-changing actions that skipped CSRF — the missing token turns a post-auth unserialize into a cross-site primitive; also note array_map('strval') widens gadget surface via __toString.

## Proof of concept (copied exactly from the original report)

**Crafted base64 serialized Gadget payload**

```
YToxOntpOjA7Tzo2OiJHYWRnZXQiOjE6e3M6NjoibWFya2VyIjtzOjIyOiJQV05FRC1GUk9NLVVOU0VSSUFMSVpFIjt9fQ%3D%3D
```