search

frohoff / ysoserial

A proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization.
http://frohoff.github.io/appseccali-marshalling-pickles/
MIT License
7.77k stars 1.76k forks source link

update C3P0 for more compatiblity. #184

Open loopx9 opened 2 years ago

loopx9 commented 2 years ago

The PoolBackedDataSource class within this payload is not nesscessary, and it does not declare a static serialVersionUID, that may get different serialVersionUID from various versions of C3P0. But the PoolBackedDataSourceBase class has a hard-coded serialVersionUID, so removing PoolBackedDataSource can make this payload more compatible with other versions of C3P0.