Description

A weakness has been identified in PHPGurukul Small CRM 4.0. This impacts the function unserialize of the file /crm/login.php of the component Login Success Handler. This manipulation of the argument geopluginURL causes deserialization. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is said to be difficult. The exploit has been made available to the public and could be used for attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.7",
  "pubDate": "2026-09-13T18:16:50.117Z",
  "pubdate": "2026-09-13T18:16:50.117Z",
  "executiveSummary": "A critical security vulnerability has been identified in PHPGurukul Small CRM version 4.0 within the Login Success Handler component. The flaw resides in the improper handling of user-supplied input during the deserialization process in the /crm/login.php file.\nSpecifically, the application insecurely processes the 'geopluginURL' argument using the 'unserialize' function. This vulnerability allows an unauthenticated remote attacker to inject malicious serialized objects, potentially leading to Remote Code Execution (RCE) or other forms of arbitrary code execution, depending on the available PHP gadget chains within the application's environment.\nAlthough the attack complexity is rated as high and exploitability is described as difficult, the public availability of exploit code significantly elevates the risk profile. Organizations using this software should consider the system compromised if exposed, as the impact involves full application compromise and potential server-side execution of malicious instructions by unauthorized remote actors.",
  "technicalDetails": "The vulnerability is rooted in an insecure deserialization flaw within the /crm/login.php component of PHPGurukul Small CRM 4.0. The application utilizes the PHP 'unserialize()' function on the 'geopluginURL' parameter without adequate validation or sanitization of the input data.\nThe attack vector involves a remote attacker supplying a specially crafted serialized object via the 'geopluginURL' argument during the authentication flow. When the 'unserialize()' function processes this input, it instantiates PHP objects based on the provided string. If an attacker can leverage existing classes defined within the application or its bundled libraries—often referred to as 'gadget chains'—they can manipulate the application's state or trigger unintended method calls during the object's wakeup or destruction phases.\nThe attack flow proceeds as follows: First, the attacker identifies the object structure compatible with the application's codebase. Second, the attacker crafts a malicious serialized payload designed to trigger a specific sequence of operations, such as file manipulation, system command execution, or sensitive data extraction. Third, the attacker transmits this payload to the '/crm/login.php' endpoint via an HTTP request. Finally, the server processes the payload through 'unserialize()', executing the attacker's logic within the context of the web server process.\nThe vulnerability is exacerbated by the lack of input filtering, allowing for the injection of arbitrary object states. Since the operation is performed remotely, it requires no prior authentication or administrative privileges to trigger the deserialization process. The successful exploitation of this flaw enables the attacker to break out of the application's intended logic, potentially gaining full control over the underlying server environment, depending on the server's configuration and the available PHP classes that can be misused as 'gadgets'.\nPost-exploitation impact includes, but is not limited to, unauthorized access to the CRM database, session hijacking, persistent backdoors in the server filesystem, and complete takeover of the hosted application. The high complexity noted in the vulnerability description is primarily due to the requirement for the attacker to identify a functional gadget chain that leads to impactful code execution within the specific environment of PHPGurukul Small CRM 4.0."
}