Executive brief
Vfront, an open-source database management interface, contains a security flaw in its Excel export component. An attacker can send specially crafted data to the server to trick the application into executing unintended commands. This could lead to unauthorized access to the database, file theft, or a complete takeover of the web server.
Technical details
A PHP Object Injection vulnerability exists in Vfront 0.99.52 within the mexcel.php file. The root cause is the insecure deserialization of the 'mexcel' POST parameter, which is passed to unserialize() after being base64 decoded without any validation or the 'allowed_classes' restriction. An unauthenticated remote attacker can exploit this by submitting a crafted base64-encoded serialized string. Successful exploitation allows the injection of arbitrary PHP objects, which can trigger gadget chains leading to Remote Code Execution (RCE), SQL Injection (CWE-89), or Path Traversal. As of the advisory date, users are advised to remove the affected file or restrict access via server configuration.
Affected products
- Vfront Vfront 0.99.52
Timeline
- 2025-08-15: other: Vulnerability discovered during code review
- 2025-10-10: other: CVE-2025-60641 assigned by MITRE
- 2025-10-11: disclosed: Public advisory published by xancatos
- 2025-10-16: advisory: NVD published date