External risk intelligence

SugarCRM PHP Object Injection Arbitrary Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2025-25034

The vulnerability exists in SugarCRM, a customer relationship management application that is typically deployed as a web-accessible service. The specific flaw resides in a REST API endpoint, which is commonly exposed to the internet to facilitate integration, mobile access, or remote client connectivity, making it a likely target for external network-based interaction.

Deserialization

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability found in SugarCRM's handling of serialized data, which, if exploited, could allow an unauthenticated attacker to execute arbitrary code on the affected system. While a prior patch existed, it was found to be incomplete, leaving certain attack vectors open. Exploitation has been observed in the wild.

Flaw allows code execution via untrusted input.
Executive attention needed to confirm relevance.
Assess exposure and prioritize remediation efforts.

Attack Path

How an attacker could exploit the issue

An attacker can reach the vulnerable code in SugarCRM by sending specially crafted input over the network to the application's REST API. The input, which is expected to be serialized PHP data, is not properly checked before being processed by a deserialization function. This allows an attacker to inject malicious code disguised as object data, which the application then executes.

Entry condition: Network access to the application.
Trigger point: Sending serialized, unvalidated data.
Resulting risk: Arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, this vulnerability could allow an unauthenticated attacker to execute arbitrary code within the SugarCRM application context by sending crafted serialized data to the REST API. This could impact the integrity and availability of the application and any data it manages.

Application code and server access.
Crafted data sent to a REST API.
Application compromise and data exposure.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners and infrastructure teams are likely responsible for addressing this PHP object injection vulnerability in SugarCRM. The initial focus should be on identifying all instances of the affected SugarCRM deployment, confirming its accessibility and business criticality, and locating the accountable owner. Subsequent remediation planning will depend on these findings and the associated risk.

Confirm application ownership and scope.
Verify external exposure and business impact.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is SugarCRM and why is it used?

SugarCRM is a customer relationship management platform used by organizations to track sales, manage customer interactions, and store sensitive business information. It functions as a web-based service that often includes a REST API to support mobile apps, remote integrations, and connectivity with other enterprise systems.

How does CVE-2025-25034 represent a PHP object injection vulnerability?

This vulnerability falls under the CWE-502 weakness class, which involves improper deserialization. Essentially, the software takes untrusted input provided by a user and converts it into a complex PHP object without checking it first. If an attacker sends a carefully formatted data string, the application may unintentionally execute malicious commands contained within that object.

What triggers the vulnerability in the REST API?

The flaw is triggered when an unauthenticated user sends a specifically crafted serialized payload to the 'rest_data' parameter in the SugarRestSerialize.php script. It is important to note that sending standard, legitimate data or interacting with non-API components of the application will not trigger this specific deserialization flaw.

How do I know if my SugarCRM instance is at risk?

Halo Surface Signal indicates that because this vulnerability affects a REST API endpoint—a component typically exposed to the internet for remote connectivity—it is considered a likely target for network-based attacks. If your deployment allows external traffic to reach this API, the risk of unauthorized access is higher.

What are the first steps to secure an affected system?

Begin by identifying all running instances of the affected SugarCRM versions and confirming which are accessible over the network. Once the inventory is complete, coordinate with the business owners of those applications to verify their criticality. Since previous patches were incomplete, prioritize determining if your version is truly protected or requires updated security measures.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.