Critical PHP Object Injection Vulnerability Exposes UNA CMS to Remote Attacks (CVE-2025-66571)

Overview

A critical PHP Object Injection vulnerability, identified as CVE-2025-66571, has been discovered in UNA CMS. This vulnerability affects versions 9.0.0-RC1 through 14.0.0-RC4. The flaw resides in the BxBaseMenuSetAclLevel.php file and stems from the improper handling of the profile_id POST parameter, which is passed to the unserialize() function without sufficient sanitization. This allows remote, unauthenticated attackers to inject arbitrary PHP objects, potentially leading to arbitrary PHP code execution on the affected server.

Technical Details

The core of the vulnerability lies in the BxBaseMenuSetAclLevel.php file. The script directly uses user-supplied input (the profile_id POST parameter) in the unserialize() function without prior validation or sanitization. The unserialize() function reconstructs a PHP object from a stored representation. If a malicious user crafts a specially designed serialized PHP object and sends it as the profile_id, the unserialize() function will reconstruct this object. This allows an attacker to instantiate arbitrary classes within the UNA CMS application context. If these classes have magic methods (such as __wakeup, __destruct, etc.), attacker-controlled code can be executed. This could lead to writing arbitrary files to the server or even executing system commands, effectively granting the attacker complete control over the compromised UNA CMS instance.

CVSS Analysis

Due to the potentially severe impact of arbitrary code execution, this vulnerability could warrant a high CVSS score. However, the reported CVSS score is currently N/A. A thorough CVSS analysis should be performed to accurately assess the risk, considering factors such as exploitability, attack vector (network), attack complexity (low), privileges required (none), user interaction (none), scope (changed), confidentiality impact (high), integrity impact (high), and availability impact (high).

Possible Impact

The impact of CVE-2025-66571 is potentially severe. Successful exploitation can lead to:

• Remote Code Execution (RCE): The attacker can execute arbitrary PHP code on the server, potentially gaining complete control of the system.
• Data Breach: Sensitive data stored in the UNA CMS database could be accessed and exfiltrated.
• Website Defacement: The attacker can modify the website content, deface it, or redirect users to malicious sites.
• Denial of Service (DoS): The attacker can crash the server or render it unavailable to legitimate users.
• Malware Distribution: The compromised server can be used to host and distribute malware to unsuspecting visitors.

Mitigation or Patch Steps

To mitigate the risk posed by CVE-2025-66571, the following steps should be taken immediately:

1. Upgrade UNA CMS: Upgrade to a patched version of UNA CMS as soon as it becomes available. Check the official UNA CMS website (https://unacms.com) for the latest security updates.
2. Input Validation: Implement robust input validation and sanitization to prevent arbitrary data from being passed to the unserialize() function. Ensure that the profile_id parameter is properly validated against a whitelist of allowed values.
3. Disable unserialize() (If Possible): If the unserialize() function is not essential for the application’s functionality, consider disabling it completely using the disable_functions directive in the php.ini file. However, assess any impact carefully before implementing this.
4. Web Application Firewall (WAF): Deploy a Web Application Firewall (WAF) with rules designed to detect and block PHP Object Injection attacks. Configure the WAF to inspect POST data for serialized PHP objects.

References

UNA CMS GitHub Repository
Karma Information Security Advisory KIS-2025-01
UNA CMS Official Website
Exploit-DB Exploit 52139
VulnCheck Advisory