A critical deserialization vulnerability in the Cotonti Comments plugin allows unauthenticated attackers to achieve remote code execution on affected systems.

The Comments plugin fails to restrict classes during the unserialize() operation on the ci GET parameter, which is processed without validation. An unauthenticated attacker can supply a malicious serialized payload to instantiate arbitrary PHP classes, leading to object injection and potential remote code execution.

This vulnerability carries a CVSS score of 9.8, reflecting its critical nature. A successful exploit grants an attacker full control over the application, enabling unauthorized database manipulation, data exfiltration, or complete system compromise. Such an event would result in severe reputational damage, operational downtime, and potential regulatory non-compliance regarding data privacy.

Immediate Action: Update the Cotonti installation to the latest available version where this deserialization flaw has been addressed. If an update is not immediately feasible, remove or disable the Comments plugin to eliminate the attack vector.

Proactive Monitoring: Review web server access logs for requests containing base64-encoded strings within the ci parameter, which may indicate exploitation attempts. Monitor system process activity for unexpected child processes spawned by the web server user.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block requests containing serialized PHP objects or suspicious base64 payloads targeting the Comments plugin.

Public Exploit Available: No

Given the critical severity and the potential for unauthenticated remote code execution, this vulnerability requires immediate attention. Security teams should prioritize patching the Cotonti environment or disabling the vulnerable Comments plugin as an interim measure. Ensure that all web-facing components are reviewed for similar insecure deserialization patterns to prevent further exposure.