Perfex CRM <=3.4.0 allows unauthenticated RCE via insecure deserialization

nullcathedral.com

Perfex CRM <=3.4.0 allows unauthenticated RCE via insecure deserialization

nullcathedral.com

cm0002@suppo.fi to

PHP@programming.dev · 9 days ago

Perfex CRM passed the autologin cookie into unserialize() without validation, giving unauthenticated attackers remote code execution.

You must log in or # to comment.

Chat

PHP@programming.dev

php@programming.dev

Create a post

You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: !php@programming.dev

Welcome to /c/php! This is a community for PHP developers and enthusiasts to share and discuss anything related to PHP. From the latest updates and tutorials, to your burning questions and amazing personal projects, we welcome all contributions.

Let’s foster an environment of respect, learning, and mutual growth. Whether you’re an experienced PHP developer, a beginner, or just interested in learning more about PHP, we’re glad to have you here!

Let’s code, learn, and grow together!

Visibility: Public

This community can be federated to other instances and be posted/commented in by their users.

2 users / day
2 users / week
21 users / month
21 users / 6 months
1 local subscriber
787 subscribers
51 Posts
0 Comments
Modlog