id: CVE-2025-53690

info:
  name: "Sitecore Experience Manager - Insecure Deserialization"
  author: vedas-arpsyndicate
  severity: critical
  description: |
    Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience
    Platform (XP) allows Code Injection.This issue affects Experience Manager (XM): through 9.0; Experience
    Platform (XP): through 9.0.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2025-53690&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=sitecore&match=exact
  classification:
    cve-id: CVE-2025-53690
  metadata:
    verified: false
  tags: cve,cve2025,kev,sitecore,deserialization,rce,zero-day
http:
  - method: GET
    path:
      - "{{BaseURL}}/sitecore/shell/sitecore.version.xml"

    extractors:
      - type: regex
        name: major
        part: body
        group: 1
        regex:
          - '\b(\d)(\d)\d{6,}\b'
        internal: true

      - type: regex
        name: minor
        part: body
        group: 2
        regex:
          - '\b(\d)(\d)\d{6,}\b'
        internal: true

      - type: dsl
        name: version
        dsl:
          - major + "." + minor
        internal: false

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

      - type: word
        words:
          - "Sitecore Corporation"
        part: body

      - type: dsl
        dsl:
          - compare_versions(version, "<= 9.0")