mcdruid.co.uk { web: development; }

In December 2025 I reported a Privilege Escalation vulnerability in the Download Manager WordPress plugin (as of version 3.3.40). This was assigned CVE-2025-15364.

The technical details of the vulnerability are quite interesting; it was exploitable via a technique called "CBC bit-flipping".

In March 2025 the Drupal Security Team released https://www.drupal.org/sa-contrib-2025-021 (assigned CVE-2025-3169) which addressed a Remote Code Execution vulnerability in the Artificial Intelligence (AI) contributed module, which is included in Drupal CMS.

I discovered this vulnerability, and I think it's an interesting one that warrants a closer look.

As part of my research into Gadget Chains and PHP Object Injection, I discovered an exploitable vulnerability in the Adianti Framework.

The maintainers were responsive to the report and have released a fix in version 8.1

https://adiantiframework.com.br/changelog#810

Details of the report:

https://gist.github.com/mcdruid/8412cfb55f443a1344ff41af0ce1b215

This vulnerability was assigned CVE-2025-3590.

As part of my research into Gadget Chains and PHP Object Injection, I discovered an exploitable vulnerability in b1gMail.

The maintainer was very responsive to the report and addressed the issue quickly. Thanks!

https://github.com/b1gMail-OSS/b1gMail/releases/tag/7.4.1-pl2

Details of the report:

https://gist.github.com/mcdruid/cb0b848c12fd6a6bc0c1b3357b983d30

As part of my research into Gadget Chains and PHP Object Injection, I discovered an exploitable vulnerability in the Pair Framework.

The maintainer, Viames, was very responsive to the report and addressed the issue quickly. Thanks!

https://github.com/viames/pair/releases/tag/2.0.0-beta

The fix was also backported to the earlier branch, with release 1.9.12

Details of the report:

As part of my research into Gadget Chains and PHP Object Injection, I discovered an unsafe deserialisation vulnerability in The Marketer OpenCart module.

There are Gadget Chains available in Opencart - including a few that I found and submitted to the PHPGGC project:

https://github.com/ambionics/phpggc/pull/199

The vulnerability in The Marketer module, combined with these Gadget Chains, allows remote unauthenticated RCE so it got a very high CVSS score.

As part of my research into Gadget Chains and PHP Object Injection, I discovered an unsafe deserialisation vulnerability in the openmass project.

The maintainers responded quickly to the report, and put a fix in place the same day:

https://github.com/massgov/openmass/commit/1966c48ecee26e1c10479af00aa0f...

The vulnerability was never exposed on the public facing website.

As part of my research into Gadget Chains and PHP Object Injection, I discovered a File Write Gadget Chain in Joomla.

I submitted a PR for this to the excellent PHPGGC project - it will hopefully be Joomla/FW1:

https://github.com/ambionics/phpggc/pull/202 (not yet merged)

I reported this to the Joomla Security Team (before submitting the PR), and they responded quickly.

Unlike some projects I've reported Gadget Chains to, they were grateful for the report and put a fix in place fast:

As part of my research into Gadget Chains and PHP Object Injection, I discovered exploitable vulnerabilities in three different XOOPS modules.

The XOOPS team responded quickly to my report, and fixes were released not long after. They were very good to work with.

They published details here:

https://xoops.org/modules/newbb/viewtopic.php?topic_id=79555

The specific fixes were:

As part of my research into Gadget Chains and PHP Object Injection, I discovered an exploitable vulnerability in the MODX Login Extra project.

The MODX team responded immediately to my report and a fix was released within hours - very impressive!

They published details here:

https://community.modx.com/t/modx-login-extra-php-object-injection-vulne...

This was assessed as: