#CodeIgniter

exploit 2026-08-19

Perfex CRM ≤ 3.4.x: Unauthenticated RCE via Cookie Deserialization

The Perfex CRM research repository documents an unauthenticated remote code execution chain caused by unsafe deserialization of the autologin cookie. The chain abuses attacker-controlled serialized data and a gadget capable of writing arbitrary content to a filesystem path.

4 min read read

exploit 2026-08-18

Perfex CRM ≤ 3.4.x: Unauthenticated RCE via Migration SQLi and Arbitrary File Upload

The Perfex CRM research repository documents a multi-stage unauthenticated compromise chain affecting versions through 3.4.x. The chain combines an unauthenticated SQL injection in the migration controller with sensitive-token extraction and an unsafe sales-attachment upload path.

4 min read read