CVE-2025-25034

CVE-2025-25034 is a critical PHP object injection vulnerability affecting SugarCRM versions prior to 6.5.24, 6.7.13, 7.5.2.5, 7.6.2.2, and 7.7.1.0, stemming from inadequate sanitization of serialized input in the SugarRestSerialize.php script. This flaw allows an unauthenticated attacker to achieve arbitrary code execution by submitting specially crafted serialized data. With a CVSS score of 9.3 (CRITICAL) and an EPSS score indicating high exploitability, the vulnerability presents a severe risk due to its network-based attack vector, low attack complexity, and potential for complete compromise of confidentiality, integrity, and availability. Exploitation evidence was observed by the Shadowserver Foundation on 2024-09-13 UTC, and public exploit modules are available in Metasploit and Nuclei, indicating active and widespread exploitation.