Executive Summary

This vulnerability exists in CodeCanyon Perfex CRM up to version 3.4.1, specifically in the Clients::project function within the application/controllers/Clients.php file of the Tenant Handler component.

The issue arises from manipulation of the argument ID, which leads to an authorization bypass, allowing an attacker to gain unauthorized access.

The attack can be performed remotely, and the exploit is publicly available.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker to bypass authorization controls, potentially gaining unauthorized access to client project information or other restricted data within the Perfex CRM system.

Since the exploit is public and the attack can be performed remotely, it increases the risk of unauthorized data exposure or manipulation.

The CVSS scores indicate a moderate severity, with impacts on confidentiality, integrity, and availability.

Useful 0 Not Useful 0