PT-2025-8962 · B1Gmail · B1Gmail

Mcdruid · Published 2025-02-27 · Updated 2025-02-27 · CVE-2025-1741

Positive Technologies · (AI Summary)

CVSS v2.0

5.8

5.8

Medium

Base vector

AV:N/AC:L/Au:M/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions:

b1gMail versions up to 7.4.1-pl1

Description:

A problematic issue was found in the Admin Page component, specifically in the file src/admin/users.php, where the manipulation of the `query/q` argument leads to deserialization. This issue can be exploited remotely. It is recommended to upgrade to a newer version to address this issue.

Recommendations:

For b1gMail versions up to 7.4.1-pl1, upgrade to version 7.4.1-pl2 to address this issue.

For b1gMail 7.4.0 commercial edition, upgrade to version 7.4.0-pl3.

Fix

Deserialization of Untrusted Data

RCE

Weakness Enumeration

CWE-502

CWE-20

Related Identifiers

CVE-2025-1741

Affected Products

B1Gmail

References · 13

• https://github.com/b1gMail-OSS/b1gMail/releases/tag/7.4.1-pl2 · Patch
• https://github.com/b1gMail-OSS/b1gMail/commit/4816c8b748f6a5b965c8994e2cf10861bf6e68aa · Patch
• https://b1gmail.eu/forum/thread/217-security-update-to-b1gmail-7-4-1-released · Patch
• https://osv.dev/vulnerability/CVE-2025-1741 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-1741 · Security Note
• https://vuldb.com/?submit.505838 · Note
• https://twitter.com/VulmonFeeds/status/1895231914635637067 · Twitter Post
• https://twitter.com/SystemTek_UK/status/1895150726009012507 · Twitter Post
• https://vuldb.com/?ctiid.297829 · Note
• https://vuldb.com/?id.297829 · Note
• https://twitter.com/CVEnew/status/1895241187008880682 · Twitter Post
• https://gist.github.com/mcdruid/cb0b848c12fd6a6bc0c1b3357b983d30 · Note
• https://t.me/cvedetector/19063 · Telegram Post