PT-2025-23614 · Phpcms · Phpcms

Dem0 · Published 2025-06-03 · Updated 2026-01-20 · CVE-2025-5499

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions slackero phpwcms versions 1.9.45 and earlier, slackero phpwcms versions 1.10.8 and earlier

Description A critical vulnerability has been found in the function is file/getimagesize of the file image resized.php. The manipulation of the argument imgfile leads to deserialization. It is possible to launch the attack remotely.

Recommendations For slackero phpwcms versions 1.9.45 and earlier, upgrade to version 1.9.46. For slackero phpwcms versions 1.10.8 and earlier, upgrade to version 1.10.9.

Exploit

Fix

Deserialization of Untrusted Data

RCE

Weakness Enumeration

CWE-502

CWE-20

Related Identifiers

CVE-2025-5499

Affected Products

Phpcms

References · 11

• 🔥 https://github.com/3em0/cve_repo/blob/main/phpwcms/image_resized%23getimagesize.md · Exploit
• https://github.com/slackero/phpwcms/releases/tag/v1.10.9 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-5499 · Security Note
• https://osv.dev/vulnerability/CVE-2025-5499 · Vendor Advisory
• https://vuldb.com/?submit.578083 · Note
• https://vuldb.com/?id.310914 · Note
• https://vuldb.com/?ctiid.310914 · Note
• https://twitter.com/CVEnew/status/1929900442210689242 · Twitter Post
• https://t.me/cvetracker/25278 · Telegram Post
• https://t.me/cveNotify/149291 · Telegram Post
• https://vuldb.com/?submit.578082 · Note