Perfex CRM vulnerabilities

In CodeCanyon Perfex CRM up to 3.4.1, the AbstractKanban::applySortQuery function in application/services/AbstractKanban.php (Admin Kanban Endpoint component) is vulnerable to SQL injection via manipulation of the this argument. The attack can be initiated remotely, and the exploit has been published and may be used.

A vulnerability was detected in CodeCanyon Perfex CRM up to 3.4.1 in the Clients::project function of application/controllers/Clients.php in the Tenant Handler component. Manipulating the ID argument results in authorization bypass. The attack may be performed remotely and the exploit is now public.

HTML injection vulnerability in Perfex CRM v3.2.1 consisting of a stored HTML injection due to lack of proper validation of user input by sending a POST request in the parameters 'subject' at the endpoint 'knowledge_base/article'.

Perfex CRM v3.2.1 contains a stored HTML injection vulnerability due to lack of proper validation of user input. The injection occurs by sending a POST request with the 'name' and 'address' parameters to the 'admin/leads/lead' endpoint.

Perfex CRM v3.2.1 contains a stored HTML injection vulnerability due to lack of proper validation of user input. The injection occurs by sending a POST request with the 'name' and 'clientid' parameters to the '/projects/project/x' endpoint.

Perfex CRM v3.2.1 contains a stored HTML injection vulnerability due to lack of proper validation of user input. The injection occurs by sending a POST request with the 'expense_name' parameter to the '/expenses/expense' endpoint.

Perfex CRM v3.2.1 contains a stored HTML injection vulnerability due to lack of proper validation of user input. The injection occurs by sending a POST request with the 'name' parameter to the '/subscriptions/create' endpoint.

HTML injection vulnerability in Perfex CRM v3.2.1 consisting of a stored HTML injection due to lack of proper validation of user input by sending a POST request in the parameter 'company' at the endpoint '/clients/client/x'.