A critical deserialization vulnerability in lty628 Aidigu versions up to 1.8.2 exposes the application to remote exploitation through improper input validation.

The vulnerability is a deserialization flaw (CWE-502) located within the checkUserCookie function in /application/common.php. An unauthenticated remote attacker can exploit this by injecting malicious input into the rememberMe argument.

The ability to trigger deserialization remotely poses a significant risk to data integrity and system availability. Given the CVSS score of 7.3, this flaw enables attackers to potentially execute arbitrary code or manipulate application states without requiring prior authentication, which could lead to full system compromise and unauthorized access to sensitive user data.

Immediate Action: Since no official patch is currently identified, users should restrict access to the affected web application via network segmentation and disable the vulnerable functionality if it is not business-critical.

Proactive Monitoring: Monitor server logs for suspicious HTTP requests containing serialized objects or unusual patterns directed at the /application/common.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) to inspect and block incoming requests containing malicious serialized payloads targeting the rememberMe parameter.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the technical write-up referenced in the vulnerability record.

Due to the availability of a public proof-of-concept and the unauthenticated nature of the attack, this vulnerability should be treated with high priority. Organizations using lty628 Aidigu must implement strict WAF filtering or network-level access controls immediately to prevent remote exploitation while awaiting a vendor-supplied security update.