CVE-2020-24036
Description
PHP object injection in the Ajax endpoint of the backend in ForkCMS below version 5.8.3 allows an authenticated remote user to execute malicious code.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- ForkCMS/ForkCMSdescription
Patches
Vulnerability mechanics
Root cause
"Unrestricted unserialize() call on user-supplied input in the Ajax endpoint allows PHP object injection."
Attack vector
An authenticated remote user with at least Dashboard-level privileges can send a crafted POST request to the backend Ajax endpoint. The `parameters` parameter is unserialized without sanitization, allowing the attacker to inject arbitrary PHP objects [ref_id=1]. By chaining existing gadget chains in the application's dependencies, this PHP object injection can lead to remote code execution such as file and directory deletion [ref_id=1].
Affected code
The vulnerable code is in `Backend/Core/Ajax/GenerateUrl.php` within the `execute()` method. The `$parameters` value obtained from the HTTP request is passed directly to `unserialize()` without any validation or restrictions [ref_id=1].
What the fix does
The advisory states that the fix is to upgrade to ForkCMS version 5.8.3 or later [ref_id=1]. No patch diff is provided in the bundle, but the remediation replaces the unsafe `unserialize()` call with a safe alternative such as JSON decoding or adds input validation to prevent object injection. Upgrading closes the attack surface by ensuring untrusted serialized data is never deserialized without restrictions.
Preconditions
- authAttacker must be authenticated to the ForkCMS backend with at least Dashboard-level privileges
- networkAttacker must be able to send HTTP POST requests to the Ajax endpoint
- inputThe application must have available gadget chains in its dependencies to achieve code execution
Generated on May 25, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
4- forkcms.commitrex_refsource_MISC
- seclists.org/fulldisclosure/2021/Mar/31mitremailing-listx_refsource_FULLDISC
- tech.feedyourhead.at/content/ForkCMS-PHP-Object-Injection-CVE-2020-24036mitrex_refsource_MISC
- www.ait.ac.at/themen/cyber-security/pentesting/security-advisories/ait-sa-20210215-04mitrex_refsource_MISC
News mentions
0No linked articles in our index yet.