VYPR
← All advisories
High severityNVD Advisory· Published Mar 30, 2015· Updated May 6, 2026

CVE-2015-2171

CVE-2015-2171

Description

Middleware/SessionCookie.php in Slim before 2.6.0 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via crafted session data.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
slim/slimPackagist
< 2.6.02.6.0

Affected products

1

Patches

1
9fa651474eb4

Fix #1034 (CVE-2015-2171)

https://github.com/slimphp/SlimScott ArciszewskiMar 2, 2015via ghsa
commit
1 file changed · +2 −2
  • Slim/Middleware/SessionCookie.php+2 −2 modified
    @@ -124,7 +124,7 @@ protected function loadSession()
 
         if ($value) {
             try {
-                $_SESSION = unserialize($value);
+                $_SESSION = json_decode($value, true);
             } catch (\Exception $e) {
                 $this->app->getLog()->error('Error unserializing session cookie value! ' . $e->getMessage());
             }
@@ -138,7 +138,7 @@ protected function loadSession()
      */
     protected function saveSession()
     {
-        $value = serialize($_SESSION);
+        $value = json_encode($_SESSION);
 
         if (strlen($value) > 4096) {
             $this->app->getLog()->error('WARNING! Slim\Middleware\SessionCookie data size is larger than 4KB. Content save failed.');

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

9

News mentions

0

No linked articles in our index yet.