CVE-2025-0841
Published: 29 January 2025
Description
A vulnerability has been found in Aridius XYZ up to 20240927 on OpenCart and classified as critical. This vulnerability affects the function loadMore of the component News. The manipulation leads to deserialization. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component.
Security Summary
CVE-2025-0841 is a critical deserialization vulnerability (CWE-20, CWE-502) affecting Aridius XYZ versions up to 20240927, a component running on OpenCart. The issue resides in the loadMore function of the News component, where remote manipulation triggers unsafe deserialization.
The vulnerability enables remote exploitation over the network (AV:N) with low attack complexity (AC:L), requiring no privileges (PR:N) or user interaction (UI:N), and without changing scope (S:U). Successful attacks can result in low impacts to confidentiality, integrity, and availability (C:L/I:L/A:L), yielding an overall CVSS 3.1 score of 7.3.
Advisories, including those from VulDB, recommend upgrading the affected Aridius XYZ component to mitigate the issue. A public exploit has been disclosed, with a proof-of-concept available on a GitHub Gist and further details on VulDB entries.
Details
- CWE(s)