MemoryLane preferences cookie gadget
A photo-album app. A shared-preferences cookie is restored with a bare unserialize() call.
PentestingHere Academy
Official Academy lab
- Attempts
- 0
- Solves
- 0
- Published
- 25 Aug 2026
Scenario
MemoryLane stores display preferences in a cookie, serialized with PHP's native format and restored with a bare unserialize() call. One class already loaded by the app has a __destruct() that acts on one of its own properties without validating it.
Goal
Forge the preferences cookie so that restoring it runs code of your choosing on the server, and use that to read /flag.txt.