CVE-2020-15148: 
PHP vulnerability analysis and mitigation

Yii 2 (yiisoft/yii2) before version 2.0.38 was discovered to be vulnerable to remote code execution if the application calls unserialize() on arbitrary user input (MITRE CVE, GitHub Advisory). The vulnerability was disclosed on September 14, 2020 and was assigned CVE-2020-15148.

The vulnerability exists in the BatchQueryResult class where unsafe deserialization of user input could occur. When an application calls unserialize() on user-controlled data containing specially crafted strings, it could lead to remote code execution (GitHub Advisory). The vulnerability received a high severity rating due to its potential impact.

If successfully exploited, this vulnerability could allow remote attackers to execute arbitrary code on the affected system when the application unsafely deserializes user input (FortiGuard). This could potentially lead to complete system compromise.

The vulnerability requires the application to call unserialize() on arbitrary user input. An attacker would need to craft a special serialized string that, when unserialized, could trigger code execution (GitHub Advisory).

The vulnerability was patched in Yii 2 version 2.0.38. For users unable to upgrade immediately, a workaround is available by adding code to BatchQueryResult.php to prevent serialization and unserialization by implementing __sleep() and __wakeup() methods that throw exceptions (GitHub Advisory).