CVE-2025-60375

CVE-2025-60375 — Authentication bypass / incorrect access control in PerfexCRM < 3.3.1 (admin login)

Summary

Vulnerability type: Incorrect Access Control — Authentication bypass
Affected product: PerfexCRM < 3.3.1
CVE: CVE-2025-60375 (Published)

Brief description:
The authentication mechanism in PerfexCRM versions prior to 3.3.1 fails to validate username/password parameters server-side. By sending empty username and password parameters in an intercepted login request, an attacker can bypass authentication and gain access to accounts (including admin accounts).

---

Affected component

• Admin login / Authentication system

Attack type

• Remote

Impact

• Privilege escalation: true (attacker can access administrative dashboard)
• Information disclosure: true (access to account-specific data)

Reproduction steps (as discovered)

1. Navigate to the PerfexCRM admin login page.
2. Intercept the login request with a proxy tool (e.g., Burp Suite).
3. Remove or empty the username and password parameters in the login request payload (send empty parameters).
4. Forward the modified request.
5. Refresh if needed; observe a 419 Page expired then automatic redirect to the dashboard.
6. The system grants access without valid credentials.

Note: Steps above are the original discovery steps reported by Ajansha Shankar and Ahamed Yaseen.

References

• OWASP Authentication Cheat Sheet — guidance on server-side validation and authentication controls.
  https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html

Mitigation / Recommended fix

• Implement strict server-side validation for authentication parameters. Reject requests with missing/empty username or password and return an appropriate 4xx response.
• Ensure session creation and authentication logic are only executed after successful credential validation.
• Add automated tests that assert empty or missing credentials never result in a successful login.
• Backport patches to all supported branches and publish CVE / advisory once fixed.

Discoverers / Credit

Ahamed Yaseen , Ajansha Shankar

CVE Links

• https://www.cve.org/CVERecord?id=CVE-2025-60375
• https://www.cvedetails.com/cve/CVE-2025-60375/
• https://nvd.nist.gov/vuln/detail/CVE-2025-60375