Back to KEVs

CVE-2025-25034

SugarCRM PHP Deserialization RCE

Basic Information

CVE State
PUBLISHED
Reserved Date
January 31, 2025
Published Date
June 20, 2025
Last Updated
May 14, 2026
Vendor
SugarCRM
Product
SugarCRM
Description
A PHP object injection vulnerability exists in SugarCRM versions prior to 6.5.24, 6.7.13, 7.5.2.5, 7.6.2.2, and 7.7.1.0 due to improper validation of PHP serialized input in the SugarRestSerialize.php script. The vulnerable code fails to sanitize the rest_data parameter before passing it to the unserialize() function. This allows an unauthenticated attacker to submit crafted serialized data containing malicious object declarations, resulting in arbitrary code execution within the application context. Although SugarCRM released a prior fix in advisory sugarcrm-sa-2016-001, the patch was incomplete and failed to address some vectors. Exploitation evidence was observed by the Shadowserver Foundation on 2024-09-13 UTC.
Tags
nuclei_scanner

CVSS Scores

CVSS v4.0

9.3 - CRITICAL

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC Information

Exploitation
poc
Technical Impact
total

Exploit Status

Exploited in the Wild
Yes (2025-11-11 00:00:00 UTC) Source

References

https://web.archive.org/web/20160725194502/http://www.sugarcrm.com/security/sugarcrm-sa-2016-008 https://web.archive.org/web/20160508053502/http://www.sugarcrm.com/security/sugarcrm-sa-2016-001 https://karmainsecurity.com/KIS-2016-07 https://www.exploit-db.com/exploits/40344 https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/sugarcrm_rest_unserialize_exec.rb https://www.sugarcrm.com/crm/ https://vulncheck.com/advisories/sugarcrm-php-deserialization-rce

Known Exploited Vulnerability Information

Source Added Date
The Shadowserver (via CIRCL) 2025-11-11 00:00:00 UTC

Scanner Integrations

Scanner URL Date Detected
Nuclei https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-25034.yaml 2026-06-01 15:34:41 UTC

Timeline

  • CVE ID Reserved

  • CVE Published to Public

  • Added to KEVIntel

  • Detected by Nuclei