Medium
Insecure Deserialization
ClubTrack bulk-import gadget chain
A hobby-club membership tracker. The same class of bug, reached only via a buried admin feature, needs two classes chained together.
PentestingHere Academy
Official Academy lab
- Attempts
- 0
- Solves
- 0
- Published
- 25 Aug 2026
Scenario
ClubTrack's public-facing code no longer deserializes anything directly, but a rarely-used "bulk import members" admin feature restores a serialized backup blob with the same bare unserialize() call.
Goal
Reach the deserialization sink behind the bulk-import feature (/admin/import.php) and chain gadgets into code execution to read /flag.txt.