An unsafe deserialization vulnerability in the MixPHP Framework 2 sync-invoke TCP server allows unauthenticated local attackers to achieve arbitrary code execution.

This is an unsafe deserialization flaw located in the sync-invoke TCP server at Server.php:87, which processes incoming TCP data using Opis Closure unserialize without authentication or signature verification. An unauthenticated attacker with local access can send a crafted serialized PHP closure to be executed via call_user_func.

A successful exploit of this vulnerability grants the attacker arbitrary code execution capabilities on the underlying host operating system. Given the CVSS score of 8.4, this high severity flaw could lead to complete system compromise, unauthorized data access, and prolonged operational downtime if left unmitigated.

Immediate Action: Restrict access to the sync-invoke TCP port, and apply vendor security updates as soon as they become available.

Proactive Monitoring: Monitor local network connections and review system logs for anomalous TCP traffic directed at the MixPHP sync-invoke service port.

Compensating Controls: Implement strict host-based firewall rules to limit local access to the loopback interface and prevent unauthorized processes from reaching the vulnerable TCP socket.

Public Exploit Available: No - although a reference gist is available, there is no confirmation of a weaponized public exploit or Metasploit module.

Administrators must treat this high severity vulnerability with urgency by auditing local network access and ensuring that proper host-based controls are in place. Applying vendor patches promptly remains the most critical step to eliminate the deserialization risk.