References https://nvd.nist.gov/vuln/detail/CVE-2025-25034 https://karmainsecurity.com/KIS-2016-07 https://www.sentinelone.com/vulnerability-database/cve-2025-25034/ https://github.com/advisories/GHSA-wcx8-f39f-5c87 https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/sugarcrm_rest_unserialize_exec.rb https://cve.imfht.com/detail/CVE-2025-25034 https://vulncheck.com/advisories/sugarcrm-php-deserialization-rce https://vulners.com/cve/CVE-2025-25034 https://avd.aliyun.com/detail?id=AVD-2025-25034 https://www.rapid7.com/db/modules/exploit/unix/webapp/sugarcrm_rest_unserialize_exec/
Related VulnerabilitiesSugarCRM /service/v4/rest.php 代码执行漏洞(CVE-2025-25034)PoCCVE-2018-5715: SugarCRM 3.5.1 - Cross-Site ScriptingPoCCVE-2019-14974: SugarCRM Enterprise 9.0.0 - Cross-Site ScriptingPoCCVE-2023-22952: SugarCRM Unauthenticated - Remote Code ExecutionPoCCVE-2025-25034: SugarCRM - Unauthenticated Remote Code Execution via PHP Object InjectionPoCsugarcrm-install: SugarCRM Exposed InstallationSugarCRM EmailTemplates CVE-2023-22952 远程代码执行漏洞SugarCRM index.php 任意文件上传漏洞(CVE-2023-22952)SugarCRM 3.5.1 XSS (CVE-2018-5715)SugarCRM-REST反序列化PHP代码执行SugarCRM-REST反序列化漏洞