EUVD-2025-18782
CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Lifecycle Timeline
4Tags
Description
A PHP object injection vulnerability exists in SugarCRM versions prior to 6.5.24, 6.7.13, 7.5.2.5, 7.6.2.2, and 7.7.1.0 due to improper validation of PHP serialized input in the SugarRestSerialize.php script. The vulnerable code fails to sanitize the rest_data parameter before passing it to the unserialize() function. This allows an unauthenticated attacker to submit crafted serialized data containing malicious object declarations, resulting in arbitrary code execution within the application context. Although SugarCRM released a prior fix in advisory sugarcrm-sa-2016-001, the patch was incomplete and failed to address some vectors. Exploitation evidence was observed by the Shadowserver Foundation on 2024-09-13 UTC.
Analysis
SugarCRM versions prior to 6.5.24, 6.7.13, 7.5.2.5, 7.6.2.2, and 7.7.1.0 contain a PHP object injection vulnerability via the SugarRestSerialize.php script. The rest_data parameter is passed to unserialize() without validation, allowing unauthenticated attackers to inject malicious PHP objects for remote code execution.
Technical Context
The SugarRestSerialize.php script deserializes the rest_data POST parameter using PHP's unserialize() function without input validation. An attacker can craft a serialized PHP object with magic methods (__destruct, __wakeup, __toString) that trigger arbitrary code execution during deserialization. SugarCRM's large codebase provides numerous gadget chains for exploitation.
Affected Products
['SugarCRM < 6.5.24', 'SugarCRM < 6.7.13', 'SugarCRM < 7.5.2.5', 'SugarCRM < 7.6.2.2', 'SugarCRM < 7.7.1.0']
Remediation
Update SugarCRM to a patched version. Restrict access to the REST API endpoint. Deploy a WAF with PHP serialization detection rules. Monitor the web root for unauthorized file creation.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today