CVE-2025-34292

{"id": "CVE-2025-34292", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-34292", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-10-27T15:19:37.331902Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.4, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/BeWelcome/rox", "vendor": "BeWelcome", "product": "Rox", "versions": [{"status": "affected", "version": "0", "lessThan": "c60bf04c2464c4bfb6cfed6372a2890ca2d0c585", "versionType": "git"}], "packageURL": "pkg:github/BeWelcome/rox", "defaultStatus": "unaffected"}]}], "published": "2025-10-27T15:15:38.317", "references": [{"url": "https://gist.github.com/mcdruid/c0f7c42b28949c7d86cf77d0c674f398", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/BeWelcome/rox", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/BeWelcome/rox/commit/c60bf04", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/rox-php-object-injection-rce", "source": "disclosure@vulncheck.com"}, {"url": "https://gist.github.com/mcdruid/c0f7c42b28949c7d86cf77d0c674f398", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-502"}]}], "descriptions": [{"lang": "en", "value": "Rox, the software running BeWelcome,\u00a0contains a PHP object injection vulnerability\u00a0resulting from deserialization of untrusted data. User-controlled input is passed to PHP's unserialize(): the POST parameter `formkit_memory_recovery` in \\\\RoxPostHandler::getCallbackAction and the 'memory cookie' read by \\\\RoxModelBase::getMemoryCookie (bwRemember). (1) If present, `formkit_memory_recovery` is processed and passed to unserialize(), and (2) restore-from-memory functionality calls unserialize() on the bwRemember cookie value. Gadget chains present in Rox and bundled libraries enable exploitation of object injection to write arbitrary files or achieve remote code execution. Successful exploitation can lead to full site compromise. This vulnerability was\u00a0remediated with commit c60bf04 (2025-06-16)."}, {"lang": "es", "value": "Rox, el software que ejecuta BeWelcome, contiene una vulnerabilidad de inyecci\u00f3n de objetos PHP resultante de la deserializaci\u00f3n de datos no confiables. La entrada controlada por el usuario se pasa a unserialize() de PHP: el par\u00e1metro POST 'formkit_memory_recovery' en \\\\RoxPostHandler::getCallbackAction y la 'cookie de memoria' le\u00edda por \\\\RoxModelBase::getMemoryCookie (bwRemember). (1) Si est\u00e1 presente, 'formkit_memory_recovery' se procesa y se pasa a unserialize(), y (2) la funcionalidad de restauraci\u00f3n desde la memoria llama a unserialize() sobre el valor de la cookie bwRemember. Las cadenas de gadgets presentes en Rox y las bibliotecas incluidas permiten la explotaci\u00f3n de la inyecci\u00f3n de objetos para escribir archivos arbitrarios o lograr la ejecuci\u00f3n remota de c\u00f3digo. La explotaci\u00f3n exitosa puede llevar a un compromiso total del sitio. Esta vulnerabilidad fue remediada con el commit c60bf04 (2025-06-16)."}], "lastModified": "2026-10-08T11:10:00.250", "sourceIdentifier": "disclosure@vulncheck.com"}