-------------------------------------------------------------------------------- Blesta <= 5.13.1 (Admin Interface) Multiple PHP Object Injection Vulnerabilities --------------------------------------------------------------------------------
[-] Software Link: https://www.blesta.com [-] Affected Versions: All versions from 3.0.0 to 5.13.1. [-] Vulnerabilities Description: The vulnerabilities exist because user input passed through the "vars" and "order_info" POST parameters when dispatching the /app/controllers/admin_clients.php script, and through the "$group_name" POST parameter when dispatching the /app/controllers/admin_company_groups.php script, is not properly sanitized before being used in a call to the unserialize() PHP function. This can be exploited by malicious administrator users to inject arbitrary PHP objects into the application scope, allowing them to perform a variety of attacks, such as executing arbitrary PHP code (RCE). [-] Proof of Concept: https://karmainsecurity.com/pocs/CVE-2026-25615.php [-] Solution: Apply the vendor patch or upgrade to version 5.13.2 or later. [-] Disclosure Timeline: [19/01/2026] - Vendor notified [20/01/2026] - Vendor response stating: “this issue was previously identified during an internal security review” [22/01/2026] - CVE identifier requested [28/01/2026] - Version 5.13.2 released [31/01/2026] - Version 5.13.3 released to address regressions introduced in 5.13.2 [03/02/2026] - CVE identifier assigned [04/02/2026] - Public disclosure [-] CVE Reference: The Common Vulnerabilities and Exposures project (cve.org) has assigned the name CVE-2026-25615 to these vulnerabilities. [-] Credits: Vulnerabilities discovered by Egidio Romano. [-] Other References: https://www.blesta.com/2026/01/28/security-advisory/ [-] Original Advisory: https://karmainsecurity.com/KIS-2026-02 _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
