Submit #913188: PHPGurukul Small CRM 4.0 Code Injection

A vulnerability, which was classified as high, has been found in PHPGurukul Small CRM 4.0. Affected is the login success handler of the file /crm/login.php. The manipulation leads to deserialization of untrusted data (PHP Object Injection).

On every successful login the application fetches the visitor geolocation from the third-party service geoplugin over plaintext HTTP and passes the unvalidated response directly to the unserialize() function without restricting allowed_classes. An on-path attacker (ARP spoofing, DNS cache poisoning, malicious hosting provider) is able to intercept or replace this response with a crafted serialized payload, which is deserialized by the server. This results in PHP Object Injection and, when a usable gadget chain is available, arbitrary code execution under the web server account.

Affected file: /crm/login.php (lines 18-22)
Vulnerable parameter: server-side third-party geolocation response (no direct request parameter required)

Vulnerable code:
$ip_address = $_SERVER['REMOTE_ADDR'];
$geopluginURL = 'http://www.geoplugin.net/php.gp?ip=' . $ip_address;
$addrDetailsArr = unserialize(file_get_contents($geopluginURL));

Proof of Concept:
1. Attacker controls the network path between the CRM server and the geolocation web service (ARP spoofing, DNS cache poisoning, or by pointing the service host to an attacker-controlled host via the hosts file for a local demo).
2. Intercept the plaintext HTTP GET request and replace the response body with a crafted serialized payload, e.g. O:8:"GadgetClass":1:{s:4:"prop";s:3:"val";}
3. Log in with valid credentials.
4. The server deserializes the attacker-controlled payload in login.php line 20.

CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H (Base Score 7.5 HIGH)

Remediation:
- Use the HTTPS JSON endpoint of the geolocation service and parse the response with json_decode().
- If unserialize() must be used, always pass array('allowed_classes' => false).

References:
- https://securized.dev/geoplugin-insecure-unserialize/
- https://www.geoplugin.com/examples
- https://cwe.mitre.org/data/definitions/502.html

• Source: ⚠️ https://github.com/JdExploit/small-crm-login-unserialize
• User: jdexploit (UID 100293)
• Submission: 08/02/2026 12:33 (1 month ago)
• Moderation: 09/12/2026 18:27 (1 month later)
• Status: Accepted
• VulDB entry: 403160 [PHPGurukul Small CRM 4.0 Login Success /crm/login.php unserialize geopluginURL deserialization]
• Points: 20