CVE-2026-90575 in Small CRM
Summary
by MITRE • 09/13/2026
A weakness has been identified in PHPGurukul Small CRM 4.0. This impacts the function unserialize of the file /crm/login.php of the component Login Success Handler. This manipulation of the argument geopluginURL causes deserialization. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is said to be difficult. The exploit has been made available to the public and could be used for attacks.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/19/2026
The vulnerability identified in PHPGurkul Small CRM version 4.0 represents a critical security flaw rooted in improper handling of user-supplied input within the application's authentication mechanism. Specifically, the defect resides in the login success handler located at /crm/login.php, where the function unserialize is invoked on data derived from the geopluginURL argument. This architectural decision allows an attacker to inject crafted serialized objects into the URL parameter, which are then processed by the PHP runtime without adequate validation or sanitization. The core technical flaw is a classic insecure deserialization vulnerability, often categorized under CWE-502 in industry standards for software weaknesses. By manipulating this specific input field, an adversary can bypass standard security controls and execute arbitrary code within the context of the web server process.
The operational impact of this vulnerability is severe due to its remote exploitability. Although the complexity of crafting a successful attack payload may be considered high by some metrics, requiring knowledge of the application's internal object structures and available classes for deserialization gadgets, the availability of public exploits significantly lowers the barrier to entry for malicious actors. Once exploited, an attacker can achieve full remote code execution on the affected server. This level of access typically allows for complete compromise of the underlying system, including theft of sensitive customer data stored within the CRM database, modification or deletion of records, and potential use of the compromised server as a pivot point for further attacks against internal network resources. The ability to execute arbitrary commands effectively grants the attacker administrative privileges over the application environment.
From an offensive security perspective, this vulnerability aligns with techniques described in the MITRE ATT&CK framework, particularly those related to command and script interpretation or remote code execution via deserialization flaws such as T1059 or specific gadget chain exploitation methods. The presence of public exploits indicates that automated scanning tools and opportunistic attackers are likely already targeting instances of this software version on the internet. Organizations relying on PHPGurkul Small CRM 4.0 face immediate risk if they have not applied mitigations or updated their systems.
To mitigate this vulnerability, it is imperative to upgrade to a patched version of PHPGurkul Small CRM where the deserialization issue has been resolved by developers through input validation and safe handling practices. If an update is not immediately available, administrators should implement strict allow-listing for any parameters passed to serialization functions or disable the unserialize function entirely if possible within the server configuration. Additionally, deploying a Web Application Firewall with rules capable of detecting serialized payload patterns can provide a layer of defense against exploitation attempts while permanent fixes are being deployed. Regular security audits and code reviews focusing on input handling in authentication modules are recommended to prevent similar insecure deserialization issues in future development cycles.