CVE-2025-11135: pmTicket Management Software RCE Flaw

CVE-2025-11135 Overview

A deserialization vulnerability has been identified in pmTicket Project-Management-Software affecting commit 2ef379da2075f4761a2c9029cf91d073474e7486 and prior versions. The vulnerability exists in the loadLanguage function within classes/class.database.php, specifically in the Cookie Handler component. An attacker can exploit this vulnerability by manipulating the user_id argument to trigger insecure deserialization, potentially leading to remote code execution or other malicious outcomes.

Critical Impact

Remote attackers can exploit this deserialization vulnerability without authentication by manipulating cookie data, potentially compromising the entire application and underlying server infrastructure.

Affected Products

• pmTicket Project-Management-Software (up to commit 2ef379da2075f4761a2c9029cf91d073474e7486)
• All versions using rolling releases prior to patch availability

Discovery Timeline

• 2025-09-29 - CVE-2025-11135 published to NVD
• 2026-04-29 - Last updated in NVD database

Technical Details for CVE-2025-11135

Vulnerability Analysis

This vulnerability is classified as an Insecure Deserialization issue (CWE-20: Improper Input Validation). The loadLanguage function in classes/class.database.php processes the user_id parameter from cookie data without proper validation or sanitization. When user-controlled input is deserialized without appropriate safeguards, attackers can craft malicious serialized objects that execute arbitrary code upon deserialization.

The vulnerability is particularly concerning because it is remotely exploitable with no authentication required and low attack complexity. The exploitation proof is publicly available, increasing the risk of active exploitation in the wild. The vendor was contacted about this disclosure but did not respond, leaving users without an official patch.

Root Cause

The root cause of this vulnerability lies in the improper handling of user-supplied input in the Cookie Handler component. The loadLanguage function accepts the user_id argument directly from cookie data and passes it to PHP's deserialization functions without validating the input's integrity or authenticity. This allows attackers to inject malicious serialized PHP objects that, when deserialized, can trigger dangerous operations through PHP magic methods like __wakeup() or __destruct().

Attack Vector

The attack vector is network-based, allowing remote exploitation without user interaction. An attacker can craft a malicious cookie containing a specially formatted serialized PHP object in the user_id parameter. When the application processes this cookie through the loadLanguage function, the malicious object is deserialized, executing the attacker's payload.

The attack flow typically involves:

1. Identifying accessible gadget chains within the application or its dependencies
2. Crafting a serialized payload that leverages these gadget chains
3. Encoding the payload and injecting it into the user_id cookie parameter
4. Sending a request to trigger the loadLanguage function
5. Achieving code execution when the application deserializes the malicious object

Technical details and an exploitation demonstration are available through the Asciinema Session Recording and additional documentation on Google Drive.

Detection Methods for CVE-2025-11135

Indicators of Compromise

• Anomalous cookie values containing serialized PHP object patterns (e.g., O:, a:, s: prefixes)
• Unusual base64-encoded strings in user_id cookie parameters
• Unexpected outbound connections from web server processes following cookie processing
• Web server logs showing requests with abnormally large or malformed cookie headers

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect serialized PHP object patterns in cookie data
• Monitor application logs for deserialization errors or exceptions in class.database.php
• Deploy runtime application self-protection (RASP) solutions to detect deserialization attacks
• Use SentinelOne Singularity to monitor for anomalous process behavior following web server activity

Monitoring Recommendations

• Enable detailed logging for the Cookie Handler component and loadLanguage function
• Implement alerting for unusual PHP process spawning from web server contexts
• Monitor file system access patterns for signs of web shell creation or unauthorized file modifications
• Track network connections initiated by the web application for command and control indicators

How to Mitigate CVE-2025-11135

Immediate Actions Required

• Restrict network access to the pmTicket application to trusted IP ranges only
• Implement a Web Application Firewall rule to block requests containing serialized PHP objects in cookies
• Consider temporarily disabling the Cookie Handler functionality if operationally feasible
• Review application logs for signs of prior exploitation attempts

Patch Information

No official patch is currently available. The pmTicket Project-Management-Software uses continuous delivery with rolling releases, and the vendor has not responded to disclosure attempts. Users should monitor the VulDB entry #326212 for updates on vulnerability status and potential fixes.

Until an official patch is released, organizations should implement the workarounds described below and consider migrating to alternative project management software if the risk is unacceptable.

Workarounds

• Deploy a reverse proxy or WAF to inspect and sanitize cookie data before it reaches the application
• Modify the loadLanguage function in classes/class.database.php to validate user_id input before deserialization
• Implement HMAC-based integrity verification for all serialized data in cookies
• Consider using json_decode() instead of unserialize() for data exchange where possible
• Apply network segmentation to limit the impact of potential compromise

# Example WAF rule to block serialized PHP objects in cookies (ModSecurity)
SecRule REQUEST_COOKIES "@rx [OaCsibd]:\d+:" \
    "id:100001,\
    phase:1,\
    deny,\
    status:403,\
    msg:'Potential PHP Object Injection in Cookie',\
    tag:'CVE-2025-11135',\
    severity:'CRITICAL'"