Executive Summary

This vulnerability is a flaw found in CodeCanyon Perfex CRM up to version 3.4.1. It affects the function AbstractKanban::applySortQuery located in the file application/services/AbstractKanban.php within the Admin Kanban Endpoint component. The flaw allows manipulation of an argument which leads to SQL injection. This means an attacker can remotely exploit this vulnerability to execute unauthorized SQL commands on the database.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can allow a remote attacker to perform SQL injection attacks, potentially leading to unauthorized access, modification, or deletion of data within the affected system. This can compromise the confidentiality, integrity, and availability of the data managed by the Perfex CRM application.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows an attacker to read the entire database, including sensitive client and project data, as well as bcrypt-wrapped password hashes. Such unauthorized access to personal and sensitive information can lead to violations of data protection regulations like GDPR and HIPAA, which mandate strict controls over the confidentiality and integrity of personal data.

The exposure of sensitive data through SQL injection can result in non-compliance with these standards, potentially leading to legal penalties, loss of trust, and the requirement to notify affected individuals and authorities.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by testing the `sort_by` parameter in the kanban-related endpoints for blind time-based SQL injection. An attacker can inject SQL commands such as the SLEEP function to observe response delays, confirming the vulnerability.

A common detection method involves sending specially crafted requests to the affected endpoints and measuring response times to detect time-based SQL injection.

• Use curl or similar tools to send requests with payloads like: ?sort_by=column_name,SLEEP(5)-- to the kanban endpoints (leads, proposals, estimates, tasks).
• Example command: curl -i 'http://target/perfexcrm/admin/kanban/leads?sort_by=id,SLEEP(5)--'
• Observe if the response time is significantly delayed (e.g., by 5 seconds), indicating the presence of the vulnerability.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation involves applying a fix that whitelists sortable columns in the `applySortQuery` method and removing the unsafe usage of the `order_by` parameter to prevent direct injection.

Until a patch is applied, restrict access to the affected endpoints and monitor for suspicious activity, especially from staff accounts with minimal permissions.

• Update Perfex CRM to a version where this vulnerability is fixed.
• Implement input validation and sanitization on the `sort_by` parameter.
• Limit staff account permissions and monitor logs for unusual queries or delays.

Useful 0 Not Useful 0