ajansha/CVE-2025-60375

GitHubRepository PoCWriteup

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a technical writeup describing an authentication bypass vulnerability in PerfexCRM. It details the vulnerability, impact, reproduction steps, and mitigation, but contains no exploit or scanner code.

Backdoor review

No backdoor observed in reviewed code

The artifact is a single README.md file that documents a known CVE-2025-60375 authentication bypass vulnerability in Perfex CRM. It contains no executable code, no instructions for the reviewer to run, and no concealed payloads. The content is a straightforward vulnerability advisory describing the issue, impact, reproduction steps, and mitigation.

ClassificationWriteup
Model confidence100%
AuthenticationNot required
Languagesenglish
Target softwarePerfexCRM
Attack typesauthentication bypass
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a README.md file containing a technical advisory with a summary, impact, reproduction steps, and mitigation for CVE-2025-60375. It does not contain any executable code, scripts, or commands that constitute an exploit or scanner. It is a substantive technical analysis, classifying it as a writeup.

README.md:1-52

Requirements

  • Ability to send HTTP requests to the admin login endpoint.README.md:20

Observed behavior

  • The writeup describes a method to bypass authentication by sending empty username and password parameters to the login endpoint, resulting in unauthorized access to user accounts, including administrative accounts.README.md:13README.md:25-27
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Vulnerability Documentation
CVE-2025-60375The file is a human-readable advisory describing an authentication bypass in Perfex CRM. It includes reproduction steps that involve manipulating HTTP requests, which is normal exploit documentation for this class of vulnerability.README.md:1-52
Review boundaries

What the analysis did not establish

  • The evidence packet contains only a single README.md file. No exploit or scanner code is present in the repository snapshot.
  • Only the README.md file was reviewed; no other files exist in the repository snapshot.
  • The review does not assess the validity or safety of the described vulnerability or its reproduction steps against a live system.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1