Different Menu in Different Pages - Insecure deserialization
Severity pending
Summary
Full name
Different Menu in Different Pages - Control Menu Visibility (All in One) trun - Insecure deserialization
Code name
State
Private
Release date
Dec 6, 2024
Affected product
Different Menu in Different Pages - Control Menu Visibility (All in One)
Affected version(s)
Version trun
Vulnerability name
Insecure deserialization
Vulnerability type
Remotely exploitable
No
CVSS v4.0 vector string
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U
Exploit available
No
CVE ID(s)
Description
Different Menu in Different Pages - Control Menu Visibility (All in One) trun was found to be vulnerable. Unvalidated user input is used directly in an unserialize function in myapp/admin/includes/AjaxRequests/save-d ifferent-menu-conditions.php.
Vulnerability
Skims by Fluid Attacks discovered a Insecure deserialization in Different Menu in Different Pages - Control Menu Visibility (All in One) trun. The following is the output of the tool:
Skims output
Our security policy
We have reserved the ID CVE-2025-22627 to refer to this issue from now on.
System Information
Version: Different Menu in Different Pages - Control Menu Visibility (All in One) trun
Mitigation
There is currently no patch available for this vulnerability.
Timeline
Vulnerability discovered
Dec 6, 2024
Vendor contacted
Jan 7, 2025