| Título | PHPGurukul Small CRM 4.0 Code Injection |
|---|
| Descrição | A vulnerability, which was classified as high, has been found in PHPGurukul Small CRM 4.0. Affected is the login success handler of the file /crm/login.php. The manipulation leads to deserialization of untrusted data (PHP Object Injection).
On every successful login the application fetches the visitor geolocation from the third-party service geoplugin over plaintext HTTP and passes the unvalidated response directly to the unserialize() function without restricting allowed_classes. An on-path attacker (ARP spoofing, DNS cache poisoning, malicious hosting provider) is able to intercept or replace this response with a crafted serialized payload, which is deserialized by the server. This results in PHP Object Injection and, when a usable gadget chain is available, arbitrary code execution under the web server account.
Affected file: /crm/login.php (lines 18-22)
Vulnerable parameter: server-side third-party geolocation response (no direct request parameter required)
Vulnerable code:
$ip_address = $_SERVER['REMOTE_ADDR'];
$geopluginURL = 'http://www.geoplugin.net/php.gp?ip=' . $ip_address;
$addrDetailsArr = unserialize(file_get_contents($geopluginURL));
Proof of Concept:
1. Attacker controls the network path between the CRM server and the geolocation web service (ARP spoofing, DNS cache poisoning, or by pointing the service host to an attacker-controlled host via the hosts file for a local demo).
2. Intercept the plaintext HTTP GET request and replace the response body with a crafted serialized payload, e.g. O:8:"GadgetClass":1:{s:4:"prop";s:3:"val";}
3. Log in with valid credentials.
4. The server deserializes the attacker-controlled payload in login.php line 20.
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H (Base Score 7.5 HIGH)
Remediation:
- Use the HTTPS JSON endpoint of the geolocation service and parse the response with json_decode().
- If unserialize() must be used, always pass array('allowed_classes' => false).
References:
- https://securized.dev/geoplugin-insecure-unserialize/
- https://www.geoplugin.com/examples
- https://cwe.mitre.org/data/definitions/502.html |
|---|
| Fonte | ⚠️ https://github.com/JdExploit/small-crm-login-unserialize |
|---|
| Utilizador | jdexploit (UID 100293) |
|---|
| Submissão | 02/08/2026 12h33 (há 1 mês) |
|---|
| Moderação | 12/09/2026 18h27 (1 month later) |
|---|
| Estado | Aceite |
|---|
| Entrada VulDB | 403160 [PHPGurukul Small CRM 4.0 Login Success /crm/login.php unserialize geopluginURL Elevação de Privilégios] |
|---|
| Pontos | 20 |
|---|