This is a detailed technical analysis of a PHP object injection vulnerability in the TCPDF library (version <= 5.9). The vulnerability allows arbitrary file deletion via the __destruct() magic method, which calls unlink() on a controlled path through the buffer property.
Classification
Writeup 95%
Attack Type
Deserialization
Complexity
Moderate
Reliability
Reliable
Target:TCPDF library <= 5.9
No auth needed
Prerequisites:Application using TCPDF library with unserialize() on user-controlled input