ajansha/cve-2025-60375Proof-of-concept for an authentication bypass in PerfexCRM prior to 3.3.1, demonstrating how empty credentials can grant unauthorized admin access.
Advisory ID: perfexcrm-auth-bypass-2025
CVE: CVE-2025-60375
Product: PerfexCRM
Affected versions: versions prior to 3.3.1 (< 3.3.1)
Reported by: Ajansha Shankar, Ahamed Yaseen
References: OWASP Authentication Cheat Sheet — https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html
An authentication bypass exists in the admin login mechanism of PerfexCRM prior to version 3.3.1. The server's authentication workflow does not sufficiently validate the presence and contents of username/password parameters. An attacker who manipulates the login request to supply empty username and password parameters may be granted access to user accounts, including administrative accounts.
/admin/auth/login).username and password fields to empty values in the request body.419 Page expired on refresh but will redirect to the dashboard and provide an authenticated session without valid credentials.Root cause (summary): insufficient server-side validation and improper control flow that allows session or application logic to mark the request as authenticated even with missing credentials.
Note: This is an estimated vector for triage. Provide a precise CVSS vector after coordinated disclosure.