PT-2025-43965 · Rox · Rox

Drew Webber · Published 2025-10-27 · Updated 2025-10-27 · CVE-2025-34292

Positive Technologies (AI Summary)

CVSS v4.0

9.4

Critical

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Rox (affected versions not specified)

Description The software contains a PHP object injection issue due to deserialization of untrusted data. User-controlled input, specifically the formkit memory recovery POST parameter in RoxPostHandler::getCallbackAction and the 'memory cookie' read by RoxModelBase::getMemoryCookie (bwRemember), is processed by PHP's unserialize() function. Gadget chains within Rox and its bundled libraries allow exploitation of this object injection to write arbitrary files or achieve remote code execution, potentially leading to full site compromise.

Recommendations Update to a version after commit c60bf04 (2025-06-16).

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2025-34292

Affected Products

Rox

References · 8

• 🔥 https://gist.github.com/mcdruid/c0f7c42b28949c7d86cf77d0c674f398 · Exploit
• https://github.com/BeWelcome/rox/commit/c60bf04 · Patch
• https://osv.dev/vulnerability/CVE-2025-34292 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-34292 · Security Note
• https://github.com/BeWelcome/rox · Note
• https://github.com/BeWelcome/rox/commit/f09be94 · Note
• https://vulncheck.com/advisories/rox-php-object-injection-rce · Note
• https://twitter.com/CVEnew/status/1982822361326829983 · Twitter Post