CVE-2025-60641 Details
Description
The file mexcel.php in the Vfront 0.99.52 codebase contains a vulnerable call to unserialize(base64_decode($_POST['mexcel'])), where $_POST['mexcel'] is user-controlled input. This input is decoded from base64 and deserialized without validation or use of the allowed_classes option, allowing an attacker to inject arbitrary PHP objects. This can lead to malicious behavior, such as Remote Code Execution (RCE), SQL Injection, Path Traversal, or Denial of Service, depending on the availability of exploitable classes in the Vfront codebase or its dependencies.
A PHP Object Injection vulnerability has been identified in Vfront version 0.99.52, specifically within the mexcel.php file. This vulnerability arises from a call to unserialize(base64_decode($_POST['mexcel'])), where the 'mexcel' parameter is user-controlled. The lack of validation and the absence of the allowed_classes option in the unserialize function allow attackers to inject arbitrary PHP objects. Exploitation of this vulnerability could lead to various malicious outcomes, including Remote Code Execution (RCE), SQL Injection, Path Traversal, or Denial of Service, depending on the presence of exploitable classes in the Vfront codebase or its dependencies.
Users are advised to remove or restrict access to mexcel.php, and to validate the 'mexcel' input by sanitizing it or using the allowed_classes option in the unserialize function.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 16, 2025CISA-ADP
Assessed Oct 16, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://xancatos.org/cve202560641 | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| Vfront | 0.99.52 (semver) |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 5, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Oct 16, 2025 | CVE Modified | CISA-ADP |
| Oct 16, 2025 | New CVE Received | [email protected] |