Exploitation Summary
EIP tracks 1 public exploit for EIP-2026-111301. PoCs published by Egidio Romano.
AI-analyzed exploit summary The writeup describes a PHP object injection vulnerability in Piwik <= 2.16.0 via the `saveLayout` method, exploitable through session corruption due to MySQL UTF8 truncation. It allows unauthenticated attackers to inject arbitrary PHP objects, leading to SSRF, file deletion, or code execution under specific conditions.
Description
Piwik 2.16.0 - 'layout' PHP Object Injection
Exploits (1)
The writeup describes a PHP object injection vulnerability in Piwik <= 2.16.0 via the `saveLayout` method, exploitable through session corruption due to MySQL UTF8 truncation. It allows unauthenticated attackers to inject arbitrary PHP objects, leading to SSRF, file deletion, or code execution under specific conditions.