CVE-2025-66571: UNA CMS PHP Object Injection Vulnerability

CVE-2025-66571 Overview

CVE-2025-66571 is a critical PHP object injection vulnerability affecting UNA CMS versions 9.0.0-RC1 through 14.0.0-RC4. The vulnerability exists in BxBaseMenuSetAclLevel.php where the profile_id POST parameter is passed to PHP's unserialize() function without proper validation or sanitization. This insecure deserialization flaw allows remote, unauthenticated attackers to inject arbitrary PHP objects, potentially leading to arbitrary file write operations and remote code execution on vulnerable systems.

Critical Impact

Unauthenticated remote attackers can exploit this PHP object injection vulnerability to achieve remote code execution, potentially gaining complete control over affected UNA CMS installations.

Affected Products

• UNA CMS versions 9.0.0-RC1 through 14.0.0-RC4

Discovery Timeline

• December 4, 2025 - CVE-2025-66571 published to NVD
• December 8, 2025 - Last updated in NVD database

Technical Details for CVE-2025-66571

Vulnerability Analysis

This vulnerability is classified as CWE-502 (Deserialization of Untrusted Data). The flaw exists in the BxBaseMenuSetAclLevel.php file within UNA CMS, where user-supplied input from the profile_id POST parameter is directly passed to PHP's unserialize() function without any input validation, sanitization, or type checking.

PHP's unserialize() function is inherently dangerous when processing untrusted input because it can instantiate arbitrary PHP objects with attacker-controlled properties. When combined with available "gadget chains" (classes with exploitable magic methods such as __destruct(), __wakeup(), or __toString()), an attacker can chain object instantiations to achieve various malicious outcomes including arbitrary file writes and code execution.

The vulnerability is remotely exploitable over the network without requiring authentication, making it particularly dangerous for internet-facing UNA CMS installations.

Root Cause

The root cause of CVE-2025-66571 is the unsafe use of PHP's unserialize() function on user-controlled input. The profile_id POST parameter is passed directly to unserialize() in BxBaseMenuSetAclLevel.php without implementing any of the recommended security controls such as:

• Input validation to ensure the data matches expected formats
• Use of allowed_classes parameter to restrict which classes can be unserialized
• Implementation of alternative safe deserialization methods like json_decode()

This design flaw allows attackers to craft malicious serialized PHP objects that, when unserialized, trigger exploitable code paths within the application or its dependencies.

Attack Vector

The attack vector for this vulnerability is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by sending a specially crafted HTTP POST request to a vulnerable UNA CMS endpoint.

The exploitation process involves:

1. Identifying a vulnerable UNA CMS installation running versions 9.0.0-RC1 through 14.0.0-RC4
2. Crafting a malicious serialized PHP object payload that leverages available gadget chains
3. Sending the payload via the profile_id POST parameter to the vulnerable endpoint
4. The server's unserialize() function processes the payload, instantiating the attacker's objects
5. Magic methods within the gadget chain execute, leading to arbitrary file write or code execution

Technical details and proof-of-concept information are available through the KarmaInSecurity Advisory KIS-2025-01 and Exploit-DB #52139.

Detection Methods for CVE-2025-66571

Indicators of Compromise

• Unusual HTTP POST requests to UNA CMS endpoints containing serialized PHP object patterns (strings starting with O:, a:, or C: followed by object definitions)
• Web server logs showing POST requests with abnormally large or encoded profile_id parameter values
• Unexpected PHP files created in web-accessible directories, particularly with recent modification timestamps
• Evidence of PHP object serialization strings containing class names not typically used by UNA CMS

Detection Strategies

• Deploy Web Application Firewall (WAF) rules to detect and block serialized PHP object patterns in HTTP POST parameters
• Implement file integrity monitoring on the UNA CMS installation directory to detect unauthorized file modifications
• Configure intrusion detection systems (IDS) to alert on network traffic containing PHP serialization signatures targeting CMS endpoints
• Review web server access logs for POST requests to URLs associated with BxBaseMenuSetAclLevel.php or ACL-related functionality

Monitoring Recommendations

• Enable verbose logging on the web server to capture full POST request bodies for forensic analysis
• Monitor for new or modified PHP files in the UNA CMS installation, especially outside of expected update windows
• Implement network traffic analysis to identify exploitation attempts targeting known PHP object injection patterns
• Set up alerts for any outbound connections from the web server that may indicate post-exploitation activity

How to Mitigate CVE-2025-66571

Immediate Actions Required

• Upgrade UNA CMS to a patched version beyond 14.0.0-RC4 immediately if one is available
• If an upgrade is not immediately possible, consider temporarily taking the vulnerable UNA CMS instance offline
• Review web server logs for signs of exploitation attempts targeting the profile_id parameter
• Implement WAF rules to block requests containing serialized PHP objects in POST parameters

Patch Information

Organizations running UNA CMS versions 9.0.0-RC1 through 14.0.0-RC4 should check the UNA CMS official website and the UNA CMS GitHub repository for security updates and patched versions. For additional vulnerability details and advisory information, refer to the VulnCheck Advisory.

Workarounds

• Deploy a Web Application Firewall with rules to detect and block PHP serialized object patterns in incoming POST requests
• Implement network-level access controls to restrict access to the UNA CMS administrative interfaces to trusted IP addresses only
• If possible, apply a code-level patch to sanitize or validate the profile_id parameter before it reaches the unserialize() function
• Consider using PHP's disable_functions directive to restrict dangerous functions, though this may impact CMS functionality