CVE-2024-40624

Description

### Summary In `torrentpier/library/includes/functions.php`, `get_tracks()` uses the unsafe native PHP serialization format to deserialize user-controlled cookies: https://github.com/torrentpier/torrentpier/blob/84f6c9f4a081d9ffff4c233098758280304bf50f/library/includes/functions.php#L41-L60 ### PoC One can use [`phpggc`](https://github.com/ambionics/phpggc/) and the chain `Guzzle/FW1` to write PHP code to an arbitrary file, and execute commands on the system. For instance, the cookie `bb_t` will be deserialized when browsing to `viewforum.php`.

How to fix CVE-2024-40624

To remediate CVE-2024-40624, upgrade the affected package to a fixed version below.

• —upgrade to 2.4.4 or later

Is CVE-2024-40624 being exploited?

Low — EPSS is 1.0%, meaning exploitation activity has not been observed at scale.

Affected packages (1)

• from 0, < 2.4.4

CVSS scores

References (5)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2024-40624
• PATCHgithub.com/torrentpier/torrentpier
• WEBgithub.com/torrentpier/torrentpier/blob/84f6c9f4a081d9ffff4c233098758280304bf50f/library/includes/functions.php#L41-L60
• WEBgithub.com/torrentpier/torrentpier/commit/ed37e6e522f345f2b46147c6f53c1ab6dec1db9e