e107 CMS up to 2.3.3 POST Parameter install.php base64_decode previous_steps deserialization

Summaryinfo

A vulnerability classified as critical has been found in e107 CMS up to 2.3.3. The affected element is the function base64_decode of the file install.php of the component POST Parameter Handler. This manipulation of the argument previous_steps causes deserialization. The identification of this vulnerability is CVE-2025-61505. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability was found in e107 CMS up to 2.3.3. It has been declared as critical. Affected by this vulnerability is the function base64_decode of the file install.php of the component POST Parameter Handler. The manipulation of the argument previous_steps with an unknown input leads to a deserialization vulnerability. The CWE definition for the vulnerability is CWE-502. The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

e107 CMS thru 2.3.3 are vulnerable to insecure deserialization in the `install.php` script. The script processes user-controlled input in the `previous_steps` POST parameter using `unserialize(base64_decode())` without validation, allowing attackers to craft malicious serialized data. This could lead to remote code execution, arbitrary file operations, or denial of service, depending on available PHP object gadgets in the codebase.

This vulnerability is known as CVE-2025-61505 since 09/26/2025. The exploitation appears to be easy. The attack can be launched remotely. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 10/11/2025).

By approaching the search of inurl:install.php it is possible to find vulnerable targets with Google Hacking.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Content Management System

Vendor

• e107

Name

• CMS

Version

• 2.3.0
• 2.3.1
• 2.3.2
• 2.3.3

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Duplicate

• Submit #XXXXXX: Xxxx.xxx Xxxx Xxx X.x.x Xxxxxxxxxxxxxxx (by lakshay12311)

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion