CVE-2025-25034
published 2025-06-20CVE-2025-25034: A PHP object injection vulnerability exists in SugarCRM versions prior to 6.5.24, 6.7.13, 7.5.2.5, 7.6.2.2, and 7.7.1.0 due to improper validation of PHP…
PriorityP182critical9.3CVSS 4.0
AVNACLATNPRNUINVCHVIHVAHSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
2.97%
85.5th percentile
A PHP object injection vulnerability exists in SugarCRM versions prior to 6.5.24, 6.7.13, 7.5.2.5, 7.6.2.2, and 7.7.1.0 due to improper validation of PHP serialized input in the SugarRestSerialize.php script. The vulnerable code fails to sanitize the rest_data parameter before passing it to the unserialize() function. This allows an unauthenticated attacker to submit crafted serialized data containing malicious object declarations, resulting in arbitrary code execution within the application context. Although SugarCRM released a prior fix in advisory sugarcrm-sa-2016-001, the patch was incomplete and failed to address some vectors. Exploitation evidence was observed by the Shadowserver Foundation on 2024-09-13 UTC.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| sugarcrm | sugarcrm | >= 6.5.0 < 6.5.23 | 6.5.23 |
| sugarcrm | sugarcrm | >= 6.7.0 < 6.7.12 | 6.7.12 |
| sugarcrm | sugarcrm | >= 7.5.0 < 7.5.2.4 | 7.5.2.4 |
| sugarcrm | sugarcrm | >= 7.6.0 < 7.6.2.1 | 7.6.2.1 |
Detection & IOCsextracted from sources · hover to see the quote
commandmethod=login&input_type=Serialize&rest_data=O:14:"SugarCacheFile":23:{S:17:"\00*\00_cacheFileName";s:22:"../{{filepath}}";S:16:"\00*\00_cacheChanged";b:1;S:14:"\00*\00_localStore";a:1:{i:0;s:30:"";}}↗
- →Monitor POST requests to /service/v4/rest.php with Content-Type: application/x-www-form-urlencoded where the body contains input_type=Serialize and rest_data beginning with a PHP serialized object (e.g., 'O:14:"SugarCacheFile"'). ↗
- →Alert on unauthenticated HTTP GET requests to files under the /custom/ directory with a .php extension, which may indicate a successfully written webshell via the SugarCacheFile __destruct() gadget chain. ↗
- →Exploitation evidence was observed in the wild by the Shadowserver Foundation on 2024-09-13 UTC; correlate logs around that date for retrospective hunting. ↗
- →The vulnerable parameter is rest_data passed to unserialize() in SugarRestSerialize.php; inspect WAF/IDS logs for serialized PHP object payloads (pattern 'O:[0-9]+:"SugarCacheFile"') in POST bodies to the REST endpoint. ↗
- ·The prior vendor patch (sugarcrm-sa-2016-001) was incomplete and did not address all exploitation vectors; instances patched only to that advisory remain vulnerable. ↗
- ·The Nuclei template uses a two-step flow: step 1 writes a PHP file via the serialized payload, step 2 GETs the dropped file to confirm execution. Detection logic must account for both requests to avoid false negatives. ↗
CVSS provenance
nvdv4.09.3CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vulncheck9.3CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-wcx8-f39f-5c87: A PHP object injection vulnerability exists in SugarCRM versions prior to 6
ghsa_unreviewed·2025-06-20
CVE-2025-25034 [CRITICAL] CWE-502 GHSA-wcx8-f39f-5c87: A PHP object injection vulnerability exists in SugarCRM versions prior to 6
A PHP object injection vulnerability exists in SugarCRM versions prior to 6.5.24, 6.7.13, 7.5.2.5, 7.6.2.2, and 7.7.1.0 due to improper validation of PHP serialized input in the SugarRestSerialize.php script. The vulnerable code fails to sanitize the rest_data parameter before passing it to the unserialize() function. This allows an unauthenticated attacker to submit crafted serialized data containing malicious object declarations, resulting in arbitrary code execution within the application context. Although SugarCRM released a prior fix in advisory sugarcrm-sa-2016-001, the patch was incomplete and failed to address some vectors.
VulnCheck
sugarcrm sugarcrm Deserialization of Untrusted Data
vulncheck·2025·CVSS 9.3
CVE-2025-25034 [CRITICAL] sugarcrm sugarcrm Deserialization of Untrusted Data
sugarcrm sugarcrm Deserialization of Untrusted Data
A PHP object injection vulnerability exists in SugarCRM versions prior to 6.5.24, 6.7.13, 7.5.2.5, 7.6.2.2, and 7.7.1.0 due to improper validation of PHP serialized input in the SugarRestSerialize.php script. The vulnerable code fails to sanitize the rest_data parameter before passing it to the unserialize() function. This allows an unauthenticated attacker to submit crafted serialized data containing malicious object declarations, resulting in arbitrary code execution within the application context. Although SugarCRM released a prior fix in advisory sugarcrm-sa-2016-001, the patch was incomplete and failed to address some vectors. Exploitation evidence was observed by the Shadowserver Foundation on 2024-09-13 UTC.
Affected: sugarcrm su
No detection rules found.
Nuclei
SugarCRM - Unauthenticated Remote Code Execution via PHP Object Injection
nuclei·CVSS 9.3
CVE-2025-25034 [CRITICAL] SugarCRM - Unauthenticated Remote Code Execution via PHP Object Injection
SugarCRM - Unauthenticated Remote Code Execution via PHP Object Injection
A PHP object injection vulnerability exists in SugarCRM versions prior to 6.5.24, 6.7.13, 7.5.2.5, 7.6.2.2, and 7.7.1.0 due to improper validation of PHP serialized input in the SugarRestSerialize.php script. The vulnerable code fails to sanitize the rest_data parameter before passing it to the unserialize() function. This allows an unauthenticated attacker to submit crafted serialized data containing malicious object declarations, resulting in arbitrary code execution within the application context. Although SugarCRM released a prior fix in advisory sugarcrm-sa-2016-001, the patch was incomplete and failed to address some vectors.
Template:
id: CVE-2025-25034
info:
name: SugarCRM - Unauthenticated Remote Code Ex
Metasploit
SugarCRM REST Unserialize PHP Code Execution
metasploit
SugarCRM REST Unserialize PHP Code Execution
SugarCRM REST Unserialize PHP Code Execution
This module exploits a PHP Object Injection vulnerability in SugarCRM CE <= 6.5.23 which could be abused to allow unauthenticated users to execute arbitrary PHP code with the permissions of the webserver. The dangerous unserialize() call exists in the '/service/core/REST/SugarRestSerialize.php' script. The exploit abuses the __destruct() method from the SugarCacheFile class to write arbitrary PHP code into the /custom directory.
No writeups or analysis indexed.
https://karmainsecurity.com/KIS-2016-07https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/sugarcrm_rest_unserialize_exec.rbhttps://vulncheck.com/advisories/sugarcrm-php-deserialization-rcehttps://web.archive.org/web/20160508053502/http://www.sugarcrm.com/security/sugarcrm-sa-2016-001https://web.archive.org/web/20160725194502/http://www.sugarcrm.com/security/sugarcrm-sa-2016-008https://www.exploit-db.com/exploits/40344https://www.sugarcrm.com/crm/
2025-06-20
Published
Exploited in the wild