CVE-2024-1225 is a high severity deserialization flaw in QiboSoft QiboCMS X1 up to version 1.0.6, scored 7.3 by NVD. The rmb_pay function accepts a callback_class argument that triggers unsafe deserialization. The record says the vendor did not respond, so no fix is confirmed.
What's affected
The record covers QiboCMS X1 up to 1.0.6. The vulnerable function is rmb_pay in the file application/index/controller/Pay.php, and the argument callback_class leads to deserialization. It can be reached remotely.
The record, which draws on VulDB entry 252847, says the exploit has been disclosed to the public and may be used. It also says the vendor was contacted early about the disclosure and did not respond in any way.
Because of that silence, I found no fixed version. The reference list contains a personal write up and VulDB pages, none of which I could confirm as a patch notice. Treat every version of QiboCMS X1 as affected unless the vendor says otherwise.
Weakness class: CWE-502. The NVD record carries the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L and a score of 7.3.
How to check if you're exposed
Search your web hosting and application inventory for QiboCMS X1. On a server you control, look for the file named in the record.
find /var/www -path '*application/index/controller/Pay.php' 2>/dev/null
Check the version file or admin dashboard of the CMS. Anything up to 1.0.6 is in scope. Then look at web logs for requests to the payment callback route carrying unusual values in callback_class.
Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan for the libraries in your own projects, and reachability analysis helps you tell which findings your code actually calls.
What to do now
- Identify every QiboCMS X1 installation, including forgotten test sites.
- Check with QiboSoft for a patched release and do not assume 1.0.6 is the last affected version.
- If you cannot get a fix, block public access to the payment callback route at the web server or firewall.
- Move to a maintained CMS if the vendor stays silent, and plan the migration.
- Review logs and file integrity on the host for signs of tampering.
Why it matters
Deserialization of untrusted data is CWE-502. When an application rebuilds objects from attacker supplied data, or lets the attacker choose which class to build, the attacker can steer code that runs during the rebuild. PHP applications have a long record of this class.
The CVSS vector here shows low impact in each category, which is why the score is 7.3 and not higher. VulDB called it critical in its own description, so the two ratings differ. I use the NVD figure. The KEV flag is false, though the record says a public exploit exists.
Quick check
Why do the vendor wording and the NVD score differ?
The record text says VulDB classified it as critical, while NVD scores it 7.3, which is High. Both are in the record.
Is there a patch?
I could not confirm one. The record says the vendor did not respond.
Sources
Last reviewed: 19 October 2026.
