CVE-2025-25034 json
SugarCRM PHP Deserialization RCE
published 2025-06-20 16 mo ago modified 2026-10-29 10 d ago also EUVD-2025-18782
- cvss
- 9.3
- version 4.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 5.0%
- EPSS 5.0% chance of exploitation in 30 days, percentile 92%
- public exploits
- 1
- Metasploit, plus a Nuclei check
Summary
A PHP object injection vulnerability exists in SugarCRM versions prior to 6.5.24, 6.7.13, 7.5.2.5, 7.6.2.2, and 7.7.1.0 due to improper validation of PHP serialized input in the SugarRestSerialize.php script. The vulnerable code fails to sanitize the rest_data parameter before passing it to the unserialize() function. This allows an unauthenticated attacker to submit crafted serialized data containing malicious object declarations, resulting in arbitrary code execution within the application context. Although SugarCRM released a prior fix in advisory sugarcrm-sa-2016-001, the patch was incomplete and failed to address some vectors. Exploitation evidence was observed by the Shadowserver Foundation on 2024-09-13 UTC.
Patch / fix
- SugarCRM SugarCRM 6.5.24, 6.7.13, 7.5.2.5, 7.6.2.2, 7.7.1.0
Timeline
- First public exploit (Metasploit exploit/unix/webapp/sugarcrm_rest_unserialize_exec)
- Published
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- total
- Assessed
- 16 mo ago
Exploit prediction
4.96% chance of exploitation in the next 30 days, higher than 92% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Metasploit exploit/unix/webapp/sugarcrm_rest_unserialize_exec SugarCRM REST Unserialize PHP Code Execution metasploit exploit, excellent rank, 2016-06-23
- Nuclei template SugarCRM - Unauthenticated Remote Code Execution via PHP Object Injection nuclei detection template
- exploit-db.com https://www.exploit-db.com/exploits/40344 referenced PoC, tagged "exploit" by a source, unverified
- raw.githubusercontent.com https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/sugarcrm_rest_unserialize_exec.rb referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 9.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| CNA | 4.0 | 9.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected products
- SugarCRM SugarCRM
Classification
- Weakness
-
- CWE-502 Deserialization of Untrusted Data
References
-
exploit-db.com
/exploits/40344
exploit
-
raw.githubusercontent.com
/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/sugarcrm_rest_unserialize_exec.rb
exploit
-
web.archive.org
/web/20160725194502/http://www.sugarcrm.com/security/sugarcrm-sa-2016-008
vendor-advisory
-
web.archive.org
/web/20160508053502/http://www.sugarcrm.com/security/sugarcrm-sa-2016-001
vendor-advisory
-
karmainsecurity.com
/KIS-2016-07
technical-description, third-party-advisory
-
sugarcrm.com
/crm/
product
-
vulncheck.com
/advisories/sugarcrm-php-deserialization-rce
third-party-advisory
Sources
- CVE List CVE-2025-25034
- NVD CVE-2025-25034
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.