Vulnerability: code/sitefeatures/PageCommentInterface.php in SilverStripe 2.4.x before 2.4.6 might allow remote attackers to execute arbitrary code via a crafted cookie in a user comment submission, which is not properly handled when it is deserialized.
Vulnerability ID: CVE-2011-4962
CWE: CWE-20
Severity score: 6.4
Project: https://github.com/silverstripe/silverstripe-cms
Published: 2012-09-17
File: code/sitefeatures/PageCommentInterface.php
Commit message: SECURITY Using JSON instead of serialize() to stringify user data in PageCommentsInterface
Commit author: Ingo Schommer

Vulnerable version (before fix):
 function PostCommentForm() { 			foreach($fields as $field) { 				if(!$field instanceof HiddenField) $visibleFields[] = $field->Name(); 			} 			$form->loadDataFrom(unserialize($cookie), false, $visibleFields); 		}  		return $form; function DeleteAllLink() {  */ class PageCommentInterface_Form extends Form { 	function postcomment($data) { 		Cookie::set("PageCommentInterface_Data", serialize($data));  		// Spam filtering 		if(SSAkismet::isEnabled()) { function postcomment($data) { 		$comment->write(); 		 		unset($data['Comment']); 		Cookie::set("PageCommentInterface_Data", serialize($data)); 		 		$moderationMsg = _t('PageCommentInterface_Form.AWAITINGMODERATION', "Your comment has been submitted and is now awaiting moderation."); 		

Fixed version (after fix):
 function PostCommentForm() { 			foreach($fields as $field) { 				if(!$field instanceof HiddenField) $visibleFields[] = $field->Name(); 			} 			$form->loadDataFrom(Convert::json2array($cookie), false, $visibleFields); 		}  		return $form; function DeleteAllLink() {  */ class PageCommentInterface_Form extends Form { 	function postcomment($data) { 		Cookie::set("PageCommentInterface_Data", Convert::raw2json($data));  		// Spam filtering 		if(SSAkismet::isEnabled()) { function postcomment($data) { 		$comment->write(); 		 		unset($data['Comment']); 		Cookie::set("PageCommentInterface_Data", Convert::raw2json($data)); 		 		$moderationMsg = _t('PageCommentInterface_Form.AWAITINGMODERATION', "Your comment has been submitted and is now awaiting moderation."); 		

Patch:
patch: @@ -222,7 +222,7 @@ function PostCommentForm() {
 			foreach($fields as $field) {
 				if(!$field instanceof HiddenField) $visibleFields[] = $field->Name();
 			}
-			$form->loadDataFrom(unserialize($cookie), false, $visibleFields);
+			$form->loadDataFrom(Convert::json2array($cookie), false, $visibleFields);
 		}
 
 		return $form;
@@ -272,7 +272,7 @@ function DeleteAllLink() {
  */
 class PageCommentInterface_Form extends Form {
 	function postcomment($data) {
-		Cookie::set("PageCommentInterface_Data", serialize($data));
+		Cookie::set("PageCommentInterface_Data", Convert::raw2json($data));
 
 		// Spam filtering
 		if(SSAkismet::isEnabled()) {
@@ -333,7 +333,7 @@ function postcomment($data) {
 		$comment->write();
 		
 		unset($data['Comment']);
-		Cookie::set("PageCommentInterface_Data", serialize($data));
+		Cookie::set("PageCommentInterface_Data", Convert::raw2json($data));
 		
 		$moderationMsg = _t('PageCommentInterface_Form.AWAITINGMODERATION', "Your comment has been submitted and is now awaiting moderation.");
path: code/sitefeatures/PageCommentInterface.php