CVE-2025-60375
BaseFortify
Publication date: 2025-10-09
Last updated on: 2025-10-14
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| perfex | crm | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-289 | The product performs authentication based on the name of a resource being accessed, or the name of the actor performing the access, but it does not properly check all possible names for that resource or actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an authentication bypass in Perfex CRM versions before 3.3.1. Due to insufficient server-side validation, attackers can send login requests with empty username and password fields and gain unauthorized access to user accounts, including administrative accounts, without providing valid credentials. [1]
How can this vulnerability impact me? :
The vulnerability allows remote attackers to bypass authentication and gain unauthorized access to user and administrative accounts. This can lead to privilege escalation, unauthorized access to sensitive data, and potential control over the CRM system's administrative functions. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by intercepting login requests to the PerfexCRM admin login page using a proxy tool such as Burp Suite. You can capture the login request and modify it by removing or emptying the username and password parameters in the request payload. If the system grants access without valid credentials after forwarding the modified request, the vulnerability exists. Commands or steps include: 1) Use a proxy tool to intercept the login POST request. 2) Modify the request payload to have empty username and password fields. 3) Forward the modified request and observe if access is granted. There are no specific command-line commands provided, but using tools like curl with crafted POST data or Burp Suite for interception and modification is recommended. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include implementing strict server-side validation to reject any login requests with missing or empty username and password parameters, returning appropriate 4xx HTTP error responses. Ensure that session creation and authentication logic only proceed after successful credential validation. Additionally, apply any available patches or updates to PerfexCRM to version 3.3.1 or later where this issue is fixed. If patches are not yet available, consider restricting access to the admin login page or monitoring for suspicious login attempts as temporary measures. [1]