Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2026-2898-FunAdmin-Deserialization — Python PoC for CVE-2026-2898 exploiting insecure deserialization in FunAdmin <=7.1.0-rc4, delivering object injection and potential RCE via crafted cloud_account parameter. For authorized testing. | Kitploit
Tools/GitHubGitHub/aykhan32/cve-2026-2898-funadmin-deserialization
Vulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingPayload Development
GitHubaykhan32/cve-2026-2898-funadmin-deserialization

CVE-2026-2898-FunAdmin-Deserialization

Python PoC for CVE-2026-2898 exploiting insecure deserialization in FunAdmin <=7.1.0-rc4, delivering object injection and potential RCE via crafted cloud_account parameter. For authorized testing.

View Repository
126 months agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2026-2898 - FunAdmin Insecure Deserialization

Summary

FunAdmin <= 7.1.0-rc4 contains an insecure deserialization vulnerability in AuthCloudService::getMember.

Technical Details

The cloud_account parameter is passed into PHP unserialize() without validation, allowing attacker-controlled object injection.

Impact

  • Object injection
  • Gadget chain execution
  • Potential RCE (depending on environment)

Tested On

FunAdmin 7.1.0-rc4 (Docker lab)

Usage

python3 exploit.py --url http://target --payload <serialized_string>

Disclaimer

For educational and authorized testing only.

Download Tool