Pimcore Unserialize RCE

This module exploits a PHP (unserialize()) in Pimcore before 5.7.1 to execute arbitrary code. An authenticated user with "classes" permission could exploit the vulnerability.

Tested on Pimcore 5.4.0-5.4.4, 5.5.1-5.6.6 with the Symfony unserialize payload.

Tested on Pimcore 4.0.0-4.6.5 with the Zend unserialize payload.