An authenticated remote code execution vulnerability in Cypht before version 2.12.2 allows attackers to compromise the web server process by injecting malicious serialized PHP objects.

The application is susceptible to CWE-502: Deserialization of Untrusted Data, specifically within the logout handler. An authenticated attacker can supply a crafted base64-encoded payload to the back_query GET parameter, which is processed by the unserialize() function without any security validation.

Successful exploitation of this vulnerability permits an attacker to execute arbitrary system commands with the privileges of the web server process. Given the high CVSS score of 8.8, this represents a significant risk to confidentiality, integrity, and availability, potentially leading to full system compromise and unauthorized access to sensitive data stored within the Cypht environment.

Immediate Action: Upgrade to Cypht version 2.12.2 or later, which includes the necessary deserialization security checks to prevent this injection vector.

Proactive Monitoring: Monitor server access logs for unusual GET requests targeting the logout handler, particularly those containing base64-encoded strings within the back_query parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to inspect and block incoming requests containing serialized PHP objects or suspicious base64 patterns in the back_query parameter.

Public Exploit Available: Unknown

The vulnerability poses a severe risk due to the potential for remote code execution. Administrators should prioritize upgrading to version 2.12.2 immediately to neutralize the threat. Ensure that all instances of Cypht are audited for unauthorized access, as the vulnerability requires a valid user account to trigger the exploit.