PT-2025-52346 · Unknown · To3K Twittodon

Solon Barroso Da Silva · Published 2025-12-18 · Updated 2025-12-20 · CVE-2025-63950

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions to3k Twittodon versions prior to commit b1c58a7d1dc664b38deb486ca290779621342c0b

Description An insecure deserialization issue exists in the download.php script of the to3k Twittodon application. The obj parameter accepts base64-encoded data which is then passed to the unserialize() function without proper validation. This allows a remote, unauthenticated attacker to inject arbitrary PHP objects, potentially causing a denial of service.

Recommendations Versions prior to commit b1c58a7d1dc664b38deb486ca290779621342c0b should be updated. As a temporary workaround, consider restricting access to the download.php script until a patch is available. Ensure the obj parameter is properly validated before being passed to the unserialize() function.

Exploit

Fix

DoS

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2025-63950

Affected Products

To3K Twittodon

References · 6

• 🔥 https://github.com/solonbarroso/vulnerability-research/blob/main/advisories/Twittodon/CVE-pending-Deserialization.md · Exploit
• 🔥 https://github.com/solonbarroso/vulnerability-research/blob/main/advisories/Twittodon/CVE-2025-63950.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-63950 · Security Note
• https://osv.dev/vulnerability/CVE-2025-63950 · Vendor Advisory
• https://t.me/CVEtracker/40185 · Telegram Post
• https://twitter.com/CVEnew/status/2002487760926708087 · Twitter Post