CVE-2025-15375 Details

A deserialization vulnerability has been identified in EyouCMS versions through 1.7.7. The issue arises in the arcpagelist functionality, where the application improperly uses the native PHP unserialize() function to deserialize data from the ey_arcmulti database table. This lack of validation allows for PHP object injection, which can be exploited using known gadget chains from ThinkPHP 5.0.24, potentially leading to remote code execution or arbitrary file deletion. Exploitation requires the ability to write to the database, either through SQL injection or other means.

The vulnerability can be addressed by using the safe_unserialize() function, which is available in the application/function.php file. Alternatively, the allowed_classes parameter can be utilized with the unserialize() function to prevent the instantiation of malicious objects. For versions of PHP that support it, switching to JSON for data serialization and deserialization is recommended.