CVE-2026-90575
Received Received - Intake

PHP Object Injection in PHPGurukul Small CRM

Publication date: 2026-09-13

Last updated on: 2026-09-13

Assigner: VulDB

Description
A weakness has been identified in PHPGurukul Small CRM 4.0. This impacts the function unserialize of the file /crm/login.php of the component Login Success Handler. This manipulation of the argument geopluginURL causes deserialization. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is said to be difficult. The exploit has been made available to the public and could be used for attacks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-13
Last Modified
2026-09-13
Generated
2026-09-13
AI Q&A
2026-09-13
EPSS Evaluated
N/A
NVD
CVE-2026-90575

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
phpgurukul small_crm 4.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-502 The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an insecure deserialization issue in PHPGurukul Small CRM 4.0. It occurs in the login success handler of /crm/login.php where the application makes an unencrypted HTTP request to a third-party geolocation service to fetch user location. The response is passed to PHP's unserialize() function without validation, allowing an attacker to inject malicious serialized data. This can lead to PHP Object Injection if a gadget chain exists.

Detection Guidance

Monitor network traffic for unencrypted HTTP requests to geoplugin.net from your CRM server during login attempts. Check server logs for unserialize() calls with external data sources. Inspect if the geopluginURL parameter in /crm/login.php receives untrusted input.

Impact Analysis

An attacker could exploit this to execute arbitrary code on the server running the CRM under the web server's account. This could allow data theft, system compromise, or further network infiltration. The attack requires network access between the CRM server and geolocation service.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality requirements and HIPAA's security rules for protected health information. Non-compliance risks include fines and legal penalties.

Mitigation Strategies

Switch to HTTPS for geolocation requests and use json_decode() instead of unserialize(). If unserialize() is required, set ['allowed_classes' => false]. Block unauthorized network modifications via ARP spoofing or DNS cache poisoning. Update to the latest Small CRM version if available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90575. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart