External risk intelligence

UNA CMS PHP Object Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2025-66571

UNA CMS is a content management system designed to be deployed as a public-facing web application. The vulnerability exists in a component handling HTTP POST parameters, which is directly reachable via the public internet in standard web deployments.

Deserialization

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This critical vulnerability in UNA CMS, a content management system, allows unauthenticated attackers to execute arbitrary PHP code. The issue stems from improper handling of a specific parameter, potentially leading to unauthorized system control. The main concern is confirming relevance and exposure.

Code injection in public-facing websites.
Critical vulnerability with remote, unauthenticated access.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

Attackers can reach the UNA CMS through the internet and exploit a PHP object injection vulnerability by sending a specially crafted POST request to the `profile_id` parameter. This allows them to inject malicious PHP objects that the system deserializes without proper validation, potentially leading to the execution of arbitrary PHP code.

Entry condition: Unauthenticated network access to UNA CMS.
Trigger point: Sending a POST request with a malicious `profile_id`.
Resulting risk: Arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

Remote, unauthenticated attackers could inject arbitrary PHP objects via a vulnerable POST parameter, potentially leading to the execution of arbitrary PHP code on the server. This occurs when the `profile_id` parameter is passed to `unserialize()` without proper validation in BxBaseMenuSetAclLevel.php.

Arbitrary PHP code execution.
PHP object injection via POST parameter.
Server compromise and data exfiltration.

Operational Fix

Recommended remediation, mitigation, and detection steps

The application owner is responsible for managing the UNA CMS instance. Infrastructure and platform teams should be consulted for deployment specifics and potential impact on shared services. The first step is to identify all UNA CMS deployments, assess their public reachability and business criticality, and then confirm the accountable owner for each.

Application owners should lead remediation.
Verify public exposure and business impact.
Plan maintenance for risk-based fixes.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is UNA CMS?

UNA CMS is a platform used to build social networks, online communities, and content-driven websites. It provides the core framework for managing user interactions, profiles, and site menus, typically running on a web server using PHP to handle dynamic page requests and data processing.

What does PHP object injection mean for CVE-2025-66571?

This vulnerability involves a weakness known as Deserialization of Untrusted Data (CWE-502). When the software processes a specific input parameter, it attempts to reconstruct a PHP object from that data. Because the input is not safely checked, an attacker can supply a malicious object that alters the application's behavior, which may allow them to run unauthorized code on your server.

How is this vulnerability triggered?

An attacker triggers the flaw by sending a specially crafted HTTP POST request to your server. They specifically target the 'profile_id' parameter in the affected component. If the request does not include this specific malicious payload, or if the request is not sent via the POST method, the vulnerable code path that calls the unsafe function is not engaged.

Is my UNA CMS deployment at risk?

According to Halo Surface Signal, this risk is elevated for most users because UNA CMS is designed to be a public-facing web application. Since the vulnerability is reachable over the network without requiring any user credentials, any instance accessible from the internet is considered to have a high potential for unauthorized access.

What should I do if I run UNA CMS?

Start by identifying all instances of UNA CMS within your environment to determine which are reachable from the internet. Once you have a complete inventory, assess the business criticality of each site. Coordinate with your platform or infrastructure teams to review the deployment and prepare for maintenance or updates provided by the vendor.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.