CVE-2025-25034
CriticalCVSS 9.3Exploitation Probability (EPSS)
Very high risk92th percentile - higher than 92% of all known CVEs
Summary
SugarCRM versions prior to 6.5.24, 6.7.13, 7.5.2.5, 7.6.2.2, and 7.7.1.0 contain a PHP object injection vulnerability due to improper validation of PHP serialized input in SugarRestSerialize.php. The rest_data parameter is not sanitized before being passed to unserialize(), allowing an unauthenticated attacker to submit crafted serialized data and achieve arbitrary code execution within the application context.
Risk Assessment
An unauthenticated attacker can execute arbitrary code in the application context, potentially leading to CRM system takeover and exposure of customer data.
Recommendation
Update SugarCRM to a version containing the complete fix (later than 6.5.24, 6.7.13, 7.5.2.5, 7.6.2.2, 7.7.1.0) and verify that the earlier patch was properly applied.
Other vulnerabilities in SugarCRM
Original NVD description (English source)
A PHP object injection vulnerability exists in SugarCRM versions prior to 6.5.24, 6.7.13, 7.5.2.5, 7.6.2.2, and 7.7.1.0 due to improper validation of PHP serialized input in the SugarRestSerialize.php script. The vulnerable code fails to sanitize the rest_data parameter before passing it to the unserialize() function. This allows an unauthenticated attacker to submit crafted serialized data containing malicious object declarations, resulting in arbitrary code execution within the application context. Although SugarCRM released a prior fix in advisory sugarcrm-sa-2016-001, the patch was incomplete and failed to address some vectors. Exploitation evidence was observed by the Shadowserver Foundation on 2024-09-13 UTC.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS