CVE-2026-90575: PHPGurukul Small CRM 4.0 RCE Vulnerability

CVE-2026-90575 Overview

CVE-2026-90575 is a PHP object deserialization weakness in PHPGurukul Small CRM 4.0. The flaw resides in the Login Success Handler within /crm/login.php, where the unserialize function processes the geopluginURL argument without adequate validation. An unauthenticated remote attacker can supply a crafted serialized payload to trigger object instantiation during login processing.

The vulnerability is classified under CWE-20: Improper Input Validation. Public proof-of-concept material is available, but exploitation complexity is described as high, limiting practical impact.

Critical Impact
Untrusted deserialization in the login flow may allow attackers to influence application state or invoke unintended object methods when suitable gadget chains exist.

Affected Products

PHPGurukul Small CRM 4.0
Component: Login Success Handler (/crm/login.php)
Vulnerable sink: unserialize() on the geopluginURL parameter

Discovery Timeline

2026-09-13 - CVE-2026-90575 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-90575

Vulnerability Analysis

The issue is an insecure deserialization flaw in the CRM login handler. When PHPGurukul Small CRM 4.0 processes a successful login, /crm/login.php passes the geopluginURL argument to PHP's unserialize() function. Because the input is attacker-controllable and lacks type or content validation, a crafted serialized object can be instantiated during the request.

Deserialization of untrusted data in PHP allows attackers to control object properties and trigger magic methods such as __wakeup, __destruct, or __toString. When paired with a viable gadget chain from application or dependency code, this behavior can escalate to file writes, arbitrary command execution, or information disclosure. The attack is remote and requires no authentication, though the reference material notes that reliable exploitation is difficult.

Exploitation details are documented in the GitHub PoC Repository and the VulDB CVE-2026-90575 entry.

Root Cause

The root cause is direct invocation of unserialize() on the geopluginURL request parameter within the Login Success Handler. The application trusts client-supplied serialized data instead of using a safe format such as JSON or applying an allow-list of expected classes through the allowed_classes option.

Attack Vector

The attack vector is network-based. An unauthenticated attacker submits a crafted geopluginURL value to the login endpoint. During processing of a successful login flow, the serialized payload is deserialized and any gadget chain present in the application classpath may execute.

No verified exploit code is reproduced here. Refer to the linked PoC repository for technical proof-of-concept details.

Detection Methods for CVE-2026-90575

Indicators of Compromise

HTTP POST requests to /crm/login.php containing a geopluginURL parameter that begins with common PHP serialization markers such as O:, a:, or s:.
Unexpected outbound network connections initiated by the PHP-FPM or web server process shortly after login requests.
Web server error logs referencing unserialize() warnings, __wakeup, or __destruct invocations tied to the login flow.

Detection Strategies

Inspect web application firewall (WAF) logs for serialized PHP payload signatures in the geopluginURL field.
Correlate login events on /crm/login.php with subsequent process execution or file writes under the web root.
Baseline normal request bodies for the login endpoint and alert on entries containing serialized object patterns.

Monitoring Recommendations

Enable verbose access and error logging on the PHP application server and forward events to a central analytics platform.
Monitor the web server user account for anomalous child processes such as sh, bash, python, or curl.
Alert on modifications to PHP source files, cron entries, or scheduled task directories after HTTP requests to the CRM login page.

How to Mitigate CVE-2026-90575

Immediate Actions Required

Restrict network access to the PHPGurukul Small CRM 4.0 login page to trusted management networks or through a VPN.
Deploy a WAF rule that blocks or sanitizes requests where geopluginURL contains PHP serialization prefixes.
Review historical web logs for prior exploitation attempts against /crm/login.php.

Patch Information

No vendor patch is referenced in the available advisories. Operators should monitor the PHPGurukul project site for updates and consider removing the application from production until a fix is issued. Additional tracking is available at VulDB Vulnerability #403160.

Workarounds

Modify /crm/login.php to remove the call to unserialize() on the geopluginURL value, or replace it with json_decode() on a validated JSON string.
If unserialize() must remain, pass ['allowed_classes' => false] as the second argument to prevent object instantiation.
Apply strict input validation that rejects any geopluginURL value not matching an expected URL pattern.

bash

# Example WAF rule concept (ModSecurity syntax)
SecRule ARGS:geopluginURL "@rx ^(O|a|s|i|b|d):[0-9]+:" \
    "id:1090575,phase:2,deny,status:400,\
     msg:'CVE-2026-90575 PHP serialized payload in geopluginURL'"