Description
A PHP object injection vulnerability exists in SugarCRM versions prior to 6.5.24, 6.7.13, 7.5.2.5, 7.6.2.2, and 7.7.1.0 due to improper validation of PHP serialized input in the SugarRestSerialize.php script. The vulnerable code fails to sanitize the rest_data parameter before passing it to the unserialize() function. This allows an unauthenticated attacker to submit crafted serialized data containing malicious object declarations, resulting in arbitrary code execution within the application context. Although SugarCRM released a prior fix in advisory sugarcrm-sa-2016-001, the patch was incomplete and failed to address some vectors. Exploitation evidence was observed by the Shadowserver Foundation on 2024-09-13 UTC.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| SugarCRM | SugarCRM | 6.5.0 – < 6.5.24, 6.7.0 – < 6.7.13, 7.5.0 – < 7.5.2.5, 7.6.0 – < 7.6.2.2, 7.7.0 – < 7.7.1.0 | 6.5.24 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
SugarCRM REST Unserialize PHP Code Execution
exploit/unix/webapp/sugarcrm_rest_unserialize_exec
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- SugarCRM - Unauthenticated Remote Code Execution via PHP Object Injection http/cves/2025/CVE-2025-25034.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
References
- https://web.archive.org/web/20160725194502/http://www.sugarcrm.com/security/sugarcrm-sa-2016-008 vendor-advisory
- https://web.archive.org/web/20160508053502/http://www.sugarcrm.com/security/sugarcrm-sa-2016-001 vendor-advisory
- https://karmainsecurity.com/KIS-2016-07 technical-description third-party-advisory
- https://www.exploit-db.com/exploits/40344 exploit
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/sugarcrm_rest_unserialize_exec.rb exploit
- https://www.sugarcrm.com/crm/ product
- https://vulncheck.com/advisories/sugarcrm-php-deserialization-rce third-party-advisory