CVE-2025-32101 Scanner

UNA CMS is a popular content management system used by developers, companies, and organizations for creating custom social networking and community portals. Its ease of customization and a variety of features make it an attractive platform for building interactive web experiences. UNA CMS supports a wide range of extensions and plugins to enhance functionality and user experience. It is widely relied upon in sectors seeking social engagement and user interaction, including educational institutions, corporations, and non-profits. The platform's robust API and module support allow developers to extend capabilities and tailor to specific needs. Given its application in managing community-based projects, integrity, and security are paramount to prevent misuse or data breaches.

The detected vulnerability is a PHP Object Injection present in UNA CMS versions <= 14.0.0-RC4. This vulnerability arises from the improper handling of input data in the PHP unserialize() function, particularly with the "profile_id" POST parameter. Such an issue permits remote attackers to inject arbitrary PHP objects, leading to potential exploitation. Attackers could manipulate this input to execute unintended operations or access sensitive data. This vulnerability is critical, posing significant risks, including total system compromise if not swiftly addressed. Correct sanitization of input data before processing with unserialize() is crucial to mitigation.

Technical details indicate that the vulnerability is located in the BxBaseMenuSetAclLevel.php script. Specifically, the BxBaseMenuSetAclLevel::getCode() method inadequately sanitizes the "profile_id" POST parameter input. This lack of sanitation allows arbitrary PHP objects to be injected, making the system susceptible to a range of exploits. The process involves manipulating serialized data to induce unexpected application behavior. Remote attackers exploit this by injecting objects capable of executing arbitrary PHP code when deserialized. The vulnerability is particularly exploitable due to the application's erroneous trust in unvalidated user input.

Exploitation of this vulnerability could result in unauthorized execution of PHP code on the server, leading to severe consequences. These could include installing malware, altering or stealing data, compromising user accounts, and ultimately taking full control of the affected system. The server's performance and functionality could be severely impacted. Additionally, sensitive information stored within the CMS could be exposed, causing reputational damage and financial loss. Immediate steps to analyze all inputs for serialization and integrate robust input validation and endpoint security are vital.

REFERENCES

• https://www.exploit-db.com/exploits/52139
• https://karmainsecurity.com/KIS-2025-01