CVE-2025-0465
Published: 14 January 2025
Description
A vulnerability was found in AquilaCMS 1.412.13. It has been rated as critical. Affected by this issue is some unknown functionality of the file /api/v2/categories. The manipulation of the argument PostBody.populate leads to deserialization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Security Summary
CVE-2025-0465 is a deserialization vulnerability in AquilaCMS version 1.412.13, rated as critical with a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). The issue affects unknown functionality in the /api/v2/categories endpoint, where manipulation of the PostBody.populate argument triggers improper input validation (CWE-20) and deserialization of untrusted data (CWE-502).
An unauthenticated remote attacker can exploit this vulnerability with low attack complexity and no user interaction. Successful exploitation allows limited impacts on confidentiality, integrity, and availability.
Advisories from VulDB and a publicly available exploit in a GitHub Gist confirm the issue, noting that the vendor was contacted early about the disclosure but provided no response. No patches or official mitigations are mentioned.
Details
- CWE(s)