Medium

PHP Object Injection in TYPO3 backend help system

IdentifiersCVE-2012-3527CWE-502· Deserialization of Untrusted Data

CVE-2012-3527 affects view_help.php in the TYPO3 backend help system in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12, and 4.7.x before 4.7.4. The vulnerable code uses PHP unserialize() on attacker-influenced input supplied through an unspecified parameter and does not properly protect the serialized data with a required integrity check/signature (HMAC). As a result, a remote authenticated backend user can supply crafted serialized data that causes arbitrary PHP objects to be instantiated during deserialization. In PHP, this object injection condition can be leveraged to trigger unintended application behavior and, depending on available gadget chains and magic methods in the installed codebase, may lead to arbitrary PHP code execution.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows a remote authenticated backend user to inject arbitrary serialized objects into the TYPO3 backend help system. The immediate impact is unsafe object instantiation and manipulation of application state during deserialization. In environments where suitable gadget chains are present, this can escalate to arbitrary PHP code execution in the context of the web application. Secondary impacts can include compromise of confidentiality, integrity, and availability of the TYPO3 instance and underlying data accessible to the application.

Mitigation

If you can’t patch tonight, do this now.

If immediate patching is not possible, restrict backend access to trusted administrators only, minimize the number of authenticated backend users, and monitor for abuse of backend help system requests involving serialized parameters. Where feasible, disable or harden the affected functionality, add integrity protection such as HMAC validation before any deserialization step, and avoid deserializing untrusted data altogether. Reducing available gadget chains in the deployed PHP/TYPO3 environment may also lower the likelihood of code execution, but this is not a substitute for patching.

Remediation

Patch, then assume compromise.

Upgrade TYPO3 to a fixed release: 4.5.19 or later for the 4.5 branch, 4.6.12 or later for the 4.6 branch, or 4.7.4 or later for the 4.7 branch. The fix should ensure serialized data processed by the backend help system is protected by a valid HMAC/signature and that untrusted input is not passed directly to unserialize().

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

DebianDebian Linuxoperating_system

Typo3Cmsapplication

Typo3Typo3application

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

cwe mitreNews

Sep 21, 2008

CWE - CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes (4.20)

PHP unserialize vulnerability in a content management system that might allow code execution.

cwe mitreNews

Jan 25, 2026

CWE - CWE-502: Deserialization of Untrusted Data (4.19.1)

Unsafe PHP unserialize() on untrusted input in a content management system, potentially allowing code execution.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity