---
id: 5112
title: "Exploiting Arbitrary Object Instantiations in PHP without Custom Classes"
source_domain: swarm.ptsecurity.com
source_url: "https://swarm.ptsecurity.com/exploiting-arbitrary-object-instantiations/"
published_at: "2022-07-14T13:18:34Z"
tags: ["rce", "php", "ldap", "object-instantiation", "lam"]
phying_url: "https://phying.com/item/5112"
lang: en
---

# Exploiting Arbitrary Object Instantiations in PHP without Custom Classes

## Summary

A pentest found an unauthenticated Arbitrary Object Instantiation flaw in LAM (LDAP Account Manager) 5.5; with no custom classes available, it was still escalated to remote code execution.

## Intelligence Metadata

- **Sources:** swarm.ptsecurity.com
- **Published:** 2022-07-14T13:18:34Z
- **Original:** https://swarm.ptsecurity.com/exploiting-arbitrary-object-instantiations/
- **Phying News:** https://phying.com/item/5112