The writeup describes a PHP object injection vulnerability in Piwik <= 2.16.0 via the `saveLayout` method, exploitable through session corruption due to MySQL UTF8 truncation. It allows unauthenticated attackers to inject arbitrary PHP objects, leading to SSRF, file deletion, or code execution under specific conditions.
Classification
Writeup 100%
Attack Type
Deserialization
Target:
Piwik <= 2.16.0
No auth needed
Prerequisites:
Piwik using database session storage (dbtable option) · PHP < 5.4.45, 5.5.29, or 5.6.13 · MySQL without utf8mb4 collation