Vulnerability · Published Feb 3, 2025 · Assigned by VulDB

CVE-2025-0974MaxD Lightning Module deserialization

Medium 5.0

In plain English

A medium-severity unsafe deserialization in Lightning Module from MaxD. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities).

Severity (CVSS 3.1)5.0Medium

Exploit odds (30 days)0.4%top 62.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was determined in MaxD Lightning Module 4.43/4.44 on OpenCart. This issue affects some unknown processing. Executing a manipulation of the argument li_op/md can lead to deserialization. The attack may be launched remotely. The attack requires a high level of complexity. The exploitability is assessed as difficult. The exploit has been publicly disclosed and may be utilized. Upgrading to version 4.45 is capable of addressing this issue. Upgrading the affected component is advised.

Affected products (as reported)

Vendor	Product	Versions
MaxD	Lightning Module	4.434.44

Weakness: CWE-502, CWE-20 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

References

VDB-294365 | MaxD Lightning Module deserialization vdb-entry, technical-description
VDB-294365 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
Submit #489672 | devs.mx OpenCart Lightning 4.43 Deserialization of Untrusted Data third-party-advisory
https://gist.github.com/mcdruid/f8153d7d535c0fcba920e83a64953d4e exploit
https://lightning.devs.mx/download patch