---
id: CVE-2025-25034
title: SugarCRM PHP Deserialization RCE
summary: >-
  A PHP object injection vulnerability exists in SugarCRM versions prior to
  6.5.24, 6.7.13, 7.5.2.5, 7.6.2.2, and 7.7.1.0 due to improper validation of
  PHP serialized input in the SugarRestSerialize.php script. The vulnerable code
  fails to…
severity: critical
cvss: 9.3
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-502
vendor: SugarCRM
product: SugarCRM
affected:
  - SugarCRM >= 6.5.0 < 6.5.24
  - SugarCRM >= 6.7.0 < 6.7.13
  - SugarCRM >= 7.5.0 < 7.5.2.5
  - SugarCRM >= 7.6.0 < 7.6.2.2
  - SugarCRM >= 7.7.0 < 7.7.1.0
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2025-06-23T15:29:51.587593Z'
exploitAvailable: true
published: '2025-06-20'
updated: '2026-10-29'
sourceUpdated: '2026-10-29T21:15:12.046Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-25034'
references:
  - url: >-
      https://web.archive.org/web/20160725194502/http://www.sugarcrm.com/security/sugarcrm-sa-2016-008
  - url: >-
      https://web.archive.org/web/20160508053502/http://www.sugarcrm.com/security/sugarcrm-sa-2016-001
  - url: 'https://karmainsecurity.com/KIS-2016-07'
  - url: 'https://www.exploit-db.com/exploits/40344'
  - url: >-
      https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/sugarcrm_rest_unserialize_exec.rb
  - url: 'https://www.sugarcrm.com/crm/'
  - url: 'https://vulncheck.com/advisories/sugarcrm-php-deserialization-rce'
tags:
  - cve.org
  - exploit-available
epss: 0.04963
epssPercentile: 0.92237
exploits:
  metasploit:
    - exploit/unix/webapp/sugarcrm_rest_unserialize_exec
  nuclei:
    - CVE-2025-25034
  checkedAt: '2026-11-07T17:49:06.404Z'
ingestedAt: '2026-11-03T08:39:35.536Z'
---

## Overview

A PHP object injection vulnerability exists in SugarCRM versions prior to 6.5.24, 6.7.13, 7.5.2.5, 7.6.2.2, and 7.7.1.0 due to improper validation of PHP serialized input in the SugarRestSerialize.php script. The vulnerable code fails to sanitize the rest_data parameter before passing it to the unserialize() function. This allows an unauthenticated attacker to submit crafted serialized data containing malicious object declarations, resulting in arbitrary code execution within the application context. Although SugarCRM released a prior fix in advisory sugarcrm-sa-2016-001, the patch was incomplete and failed to address some vectors. Exploitation evidence was observed by the Shadowserver Foundation on 2024-09-13 UTC.

## Affected

- `SugarCRM >= 6.5.0 < 6.5.24`
- `SugarCRM >= 6.7.0 < 6.7.13`
- `SugarCRM >= 7.5.0 < 7.5.2.5`
- `SugarCRM >= 7.6.0 < 7.6.2.2`
- `SugarCRM >= 7.7.0 < 7.7.1.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.