CVE-2020-15148

This repository contains multiple proof-of-concept exploits for CVE-2020-15148, a Yii2 deserialization vulnerability. The PoCs demonstrate different bypass techniques to achieve remote code execution (RCE) via crafted serialized payloads.

This PoC demonstrates a PHP deserialization vulnerability (CVE-2020-15148) in Yii2 applications, leveraging a gadget chain to achieve remote code execution (RCE) via the `system` function. The exploit constructs a malicious serialized payload that triggers arbitrary command execution when deserialized.