PHP Object Injection Vulnerability Analysis and POC Examples

PHP Object Injection Vulnerability Summary Vulnerability Overview PHP Object Injection is an application-layer vulnerability that allows attackers to perform various malicious actions, such as code injection, SQL injection, path traversal, and application denial of service. This vulnerability occurs when user input is passed to PHP functions that deserialize objects without proper sanitization. Since PHP supports object serialization, attackers can pass malicious serialized strings to vulnerable calls, thereby injecting arbitrary PHP objects into the application scope. Scope of Impact Conditions: - The application must contain a class that implements PHP magic methods (such as or ), which can be used to execute malicious attacks or trigger "POP chains". - All classes used during the attack must be declared at the time the vulnerable is called; otherwise, object autoloading must be supported. Remediation Avoid using the function to process user-provided input. It is recommended to use JSON functions instead. Example Code Example 1 Example 2 Example 3 Related Controls Input Validation Static Code Analysis References PHP: unserialize PHP: Magic Methods PHP: Autoloading Classes PHP RFC: Secured unserialize() Shocking News in PHP Exploitation Stefan Esser, POC 2009 Utilizing Code Reuse/ROP in PHP Application Exploits Stefan Esser, BlackHat USA 2010 Category Injection Edit Edit on GitHub Sponsors Spotlight: Arnica Corporate Supporters: GuidePoint, Guardsquare, Check Point, Bloomberg, SQL, Fortify, Adobe, SCSK Privacy Policy Privacy Sitemap Contact Copyright OWASP, the OWASP logo, and Global AppSec are registered trademarks and AppSec Days, AppSec California, AppSec Call, SnowFROC, OWASP Boston Application Security Conference, and LASCON are trademarks of the OWASP Foundation, Inc. Unless otherwise specified, all content on the site is Creative Commons Attribution-ShareAlike v4.0 and provided without warranty of service or accuracy. For more information, please refer to our General Disclaimer. OWASP does not endorse or recommend commercial products or services, allowing our community to remain vendor neutral with the collective wisdom of the best minds in software security worldwide. Copyright 2026, OWASP Foundation, Inc.

Goal Reached Thanks to every supporter — we hit 100%!

PHP Object Injection Vulnerability Analysis and POC Examples