CVE-2022-21663 WordPress Nesne Yerleştirme Güvenlik Açığı

597  function maybe_serialize( $data ) {
 598         if ( is_array( $data ) || is_object( $data ) ) {
 599                 return serialize( $data );
 600         }
 601
 602         /*
 603          * Double serialization is required for backward compatibility.
 604          * See https://core.trac.wordpress.org/ticket/12930
 605          * Also the world will end. See WP 3.6.1.
 606          */
 607         if ( is_serialized( $data, false ) ) {
 608                 return serialize( $data );
 609         }
 610
 611         return $data;

wordpress/wp-includes/functions.php
 622 function maybe_unserialize( $data ) {
 623         if ( is_serialized( $data ) ) {
 624                 return @unserialize( trim( $data ) );
 625         }
 626
 627         return $data;
 628 }

18 /**
 19  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.
 20  *
 21  * @global int $wp_db_version
 22  */
 23 $wp_db_version = 49752;

wordpress/wp-admin/includes/upgrade.php
 636 function wp_upgrade() {
 637   global $wp_current_db_version, $wp_db_version, $wpdb;
 638
 639   $wp_current_db_version = __get_option( 'db_version' );
 640
 641   // We are up to date. Nothing to do.
 642   if ( $wp_db_version == $wp_current_db_version ) {
 643       return;
 644   }
 645
 646   if ( ! is_blog_installed() ) {
 647       return;
 648   }
 649
      // …
 654   upgrade_all();
 754       // …
 755   if ( $wp_current_db_version < 8989 ) {
 756       upgrade_270();
 757   }
 758
 759   if ( $wp_current_db_version < 10360 ) {
 760       upgrade_280();
 761   }
 762   // …

wordpress/wp-admin/includes/upgrade.php
1605 function upgrade_280() {
1606     global $wp_current_db_version, $wpdb;
1607
1608     if($wp_current_db_version < 10360 ) {
1609         populate_roles_280();
1610     }
1611     if(is_multisite() ) {
1612         $start = 0;
1613         while($rows = $wpdb->get_results( "SELECT option_name, option_value FROM $wpdb->options ORDER BY option_id LIMIT $start, 20")){
1614             foreach ( $rows as $row ) {
1615                 $value = $row->option_value;
1616                 if ( ! @unserialize( $value ) ) {
1617                     $value = stripslashes( $value );
1618                 }

677     $token = $data[0];
 678     switch ( $token ) {
 679         case 's':
 680             if ( $strict ) {
 681                 if ( '"' !== substr( $data, -2, 1 ) ) {
 682                     return false;
 683                 }
 684             } elseif ( false === strpos( $data, '"' ) ) {
 685                 return false;
 686             }
 687             // Or else fall through.
 688         case 'a':
 689         case 'O':
 690             return (bool) preg_match( "/^{$token}:[0-9]+:/s", $data );
 691         case 'b':
 692         case 'i':
 693         case 'd':
 694             $end = $strict ? '$' : '';
 695             return (bool) preg_match( "/^{$token}:[0-9.E+-]+;$end/", $data );
 696     }
 697     return false;