PT-2025-6104 · Dayrui · Xunruicms

P1Wy · Published 2025-02-10 · Updated 2025-07-03 · CVE-2025-1186

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: dayrui XunRuiCMS versions up to 4.6.4

Description: A critical issue has been identified, affecting unknown code in the /Control/Api/Api.php file. The manipulation of the thumb argument leads to deserialization. This issue can be exploited remotely. The exploit has been publicly disclosed and may be used.

Recommendations: For dayrui XunRuiCMS versions up to 4.6.4, consider disabling the deserialization functionality related to the thumb argument in the /Control/Api/Api.php file as a temporary workaround until a patch is available. Restrict access to the /Control/Api/Api.php file to minimize the risk of exploitation. Avoid using the thumb argument in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Deserialization of Untrusted Data

RCE

Weakness Enumeration

CWE-502

CWE-20

Related Identifiers

CVE-2025-1186

Affected Products

Xunruicms

References · 13

• 🔥❌ https://github.com/pwysec/d6qRhl/blob/main/1.pdf · Exploit, Deleted
• https://nvd.nist.gov/vuln/detail/CVE-2025-1186 · Security Note
• https://osv.dev/vulnerability/CVE-2025-1186 · Vendor Advisory
• https://t.me/cvenotify/111011 · Telegram Post
• https://vuldb.com/?id.295090 · Note
• https://vuldb.com/?submit.495820 · Note
• https://t.me/cvenotify/127537 · Telegram Post
• https://twitter.com/CVEnew/status/1889673502896107577 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1889593734641119494 · Twitter Post
• https://twitter.com/dailycve/status/1940663485966569585 · Twitter Post
• https://twitter.com/WolfgangSesin/status/1888922798229274716 · Twitter Post
• https://vuldb.com/?ctiid.295090 · Note
• https://t.me/cvedetector/17826 · Telegram Post