{“lastseen”:”2025-10-15T19:36:03″,”description”:”PerfexCRM……………………………………………”,”published”:”2025-10-15T00:00:00″,”modified”:”2025-10-15T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 PerfexCRM Authentication Bypass”,”source”:””,”references”:””,”id”:”PACKETSTORM:210540″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-60375″],”sourceData”:”# Security Advisory \u2014 PerfexCRM Authentication Bypass (CVE-2025-60375, RESERVED)\\n \\n **Advisory ID:** perfexcrm-auth-bypass-2025 \\n **CVE:** CVE-2025-60375 (RESERVED) \\n **Product:** PerfexCRM \\n **Affected versions:** versions prior to 3.3.1 (\\u003c 3.3.1) \\n **Date discovered:** [replace with discovery date] \\n **Reported by:** Ajansha Shankar, Ahamed Yaseen \\n **References:** OWASP Authentication Cheat Sheet \u2014 https:\/\/cheatsheetseries.owasp.org\/cheatsheets\/Authentication_Cheat_Sheet.html\\n \\n —\\n \\n ## Summary\\n An authentication bypass exists in the admin login mechanism of PerfexCRM prior to version 3.3.1. The server’s authentication workflow does not sufficiently validate the presence and contents of username\/password parameters. An attacker who manipulates the login request to supply empty username and password parameters may be granted access to user accounts, including administrative accounts.\\n \\n —\\n \\n ## Impact\\n – Unauthorized access to user accounts (including admin). \\n – Potential full compromise of the application and sensitive data exposure. \\n – Remote exploitation \u2014 attacker only needs the ability to send HTTP requests to the login endpoint.\\n \\n —\\n \\n ## Technical details \\u0026 reproduction\\n 1. Intercept the POST request sent to the admin login endpoint (e.g., `\/admin\/auth\/login`). \\n 2. Remove or set `username` and `password` fields to empty values in the request body. \\n 3. Forward the modified request. The server may respond with `419 Page expired` on refresh but will redirect to the dashboard and provide an authenticated session without valid credentials.\\n \\n **Root cause (summary):** insufficient server-side validation and improper control flow that allows session or application logic to mark the request as authenticated even with missing credentials.\\n \\n —\\n \\n ## Mitigation \/ Remediation\\n – Fix server-side authentication: reject requests missing username or password with an explicit 4xx error (e.g., 400\/401). \\n – Ensure session creation and privilege assignment only happen after successful credential verification. \\n – Add unit and integration tests to validate behavior against empty\/missing credential values. \\n – Consider adding rate-limiting and monitoring for suspicious login attempts while fix is deployed.\\n \\n —\\n \\n ## Suggested CVSS (example)\\n – CVSS v3.1 (example): **7.8 (High)** \u2014 AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:N \\n \\u003e Note: This is an estimated vector for triage. Provide a precise CVSS vector after coordinated disclosure.\\n \\n —\\n \\n ## Contact \/ Credit\\n – Reported by: Ajansha Shankar and Ahamed Yaseen”,”sourceHref”:”https:\/\/packetstorm.news\/download\/210540″,”cvss”:{“score”:7.3,”severity”:”HIGH”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:L\/I:L\/A:L”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/210540\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-10-15T19:36:03″,”description”:”PerfexCRM……………………………………………”,”published”:”2025-10-15T00:00:00″,”modified”:”2025-10-15T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 PerfexCRM Authentication Bypass”,”source”:””,”references”:””,”id”:”PACKETSTORM:210540″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-60375″],”sourceData”:”# Security Advisory \u2014 PerfexCRM Authentication Bypass (CVE-2025-60375, RESERVED)\\n \\n **Advisory ID:** perfexcrm-auth-bypass-2025 \\n **CVE:** CVE-2025-60375 (RESERVED) \\n **Product:** PerfexCRM \\n **Affected…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,47,12,15,13,53,7,11,5],"class_list":["post-21967","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-cvss-73","tag-exploit","tag-high","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n