PT-2025-49139 · Una Cms · Unak-Cms

Published 2025-12-04 · Updated 2025-12-05 · CVE-2025-66571

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions UNA CMS versions 9.0.0-RC1 through 14.0.0-RC4

Description The software contains a PHP object injection issue in the BxBaseMenuSetAclLevel.php component. The profile id POST parameter is passed to the PHP unserialize() function without sufficient validation, potentially allowing remote, unauthenticated attackers to inject arbitrary PHP objects and execute code.

Recommendations Versions 9.0.0-RC1 through 14.0.0-RC4: Ensure proper handling of the profile id POST parameter before passing it to the PHP unserialize() function.

Exploit

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2025-66571

Affected Products

Unak-Cms

References · 9

• 🔥 https://exploit-db.com/exploits/52139 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-66571 · Security Note
• https://osv.dev/vulnerability/CVE-2025-66571 · Vendor Advisory
• https://github.com/unacms/una · Note
• https://karmainsecurity.com/KIS-2025-01 · Note
• https://vulncheck.com/advisories/una-cms-900-rc1-1400-rc4-php-object-injection · Note
• https://twitter.com/CVEnew/status/1996685094291972498 · Twitter Post
• https://unacms.com · Note
• https://twitter.com/VulmonFeeds/status/1996846178860667049 · Twitter Post