CVE-2025-60375

HIGH
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2025-60375 has a selected CVSS score of 7.3 (high); EIP currently links 2 repository PoCs.

Description

The authentication mechanism in Perfex CRM before 3.3.1 allows attackers to bypass login credentials due to insufficient server-side validation. By sending empty username and password parameters in the login request, an attacker can gain unauthorized access to user accounts, including administrative accounts, without providing valid credentials.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
2

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Oct 10, 2025 · Source: CVE List

Proofs of concept

2

Repository PoCs

GitHubAhamedYaseen03/CVE-2025-60375Repository PoCby AhamedYaseen030Writeup2 files

4.9 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a README file that provides a technical writeup for CVE-2025-60375, describing an authentication bypass vulnerability in Perfex CRM. It details the vulnerability type, affected component, impact, and reproduction steps, but contains no executable exploit or scanner code.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists solely of a README.md file describing a known CVE (CVE-2025-60375) for Perfex CRM. The file contains a vulnerability summary, reproduction steps, mitigation advice, and references. No executable code, scripts, obfuscated payloads, or instructions to run untrusted software are present. The described exploit targets a third-party application (Perfex CRM) and does not direct any harmful action toward the reviewer. No backdoor or deceptive payload aimed at the reviewer is observed.

ClassificationWriteup
Model confidence95%
AuthenticationNot required
LanguagesEnglish
Target softwarePerfex CRM
Attack typesAuthentication Bypass
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a README file containing a technical description of a vulnerability, its impact, and reproduction steps. It does not include any source code, scripts, or commands that could be executed to exploit or scan for the vulnerability. The content is purely a written analysis, which matches the definition of a writeup.

README.md:1-52

Requirements

  • Access to the Perfex CRM admin login page.README.md:25
  • A proxy tool (e.g., Burp Suite) to intercept and modify the login request.README.md:26

Observed behavior

  • Describes sending empty username and password parameters in a login request to bypass authentication and gain unauthorized access to user accounts, including administrative accounts.README.md:10README.md:27-30
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Vulnerability Description
CVE-2025-60375 authentication bypass in Perfex CRM < 3.3.1The README documents a known vulnerability in a third-party product, not a backdoor in the PoC artifact itself.README.md:1-10
Reproduction Steps
Steps to exploit the Perfex CRM vulnerability using a proxy toolThe steps describe normal exploit behavior against the stated target (Perfex CRM) and do not instruct the reviewer to execute any code or install software.README.md:24-30
Review boundaries

What the analysis did not establish

  • The artifact contains only a README.md file; one other file (likely a license) was omitted from the text evidence, but its absence does not affect the classification as it is not expected to contain code.
  • The analysis is based solely on the provided text; no code was executed, and the described vulnerability is not verified.
  • One additional file in the repository was not included in the text evidence and was flagged as metadata-only, not analyzed. Its content is unknown.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

GitHubajansha/CVE-2025-60375Repository PoCby ajansha0Writeup1 file

2.5 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a technical writeup describing an authentication bypass vulnerability in PerfexCRM. It details the vulnerability, impact, reproduction steps, and mitigation, but contains no exploit or scanner code.

Backdoor review

No backdoor observed in reviewed code

The artifact is a single README.md file that documents a known CVE-2025-60375 authentication bypass vulnerability in Perfex CRM. It contains no executable code, no instructions for the reviewer to run, and no concealed payloads. The content is a straightforward vulnerability advisory describing the issue, impact, reproduction steps, and mitigation.

ClassificationWriteup
Model confidence100%
AuthenticationNot required
Languagesenglish
Target softwarePerfexCRM
Attack typesauthentication bypass
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a README.md file containing a technical advisory with a summary, impact, reproduction steps, and mitigation for CVE-2025-60375. It does not contain any executable code, scripts, or commands that constitute an exploit or scanner. It is a substantive technical analysis, classifying it as a writeup.

README.md:1-52

Requirements

  • Ability to send HTTP requests to the admin login endpoint.README.md:20

Observed behavior

  • The writeup describes a method to bypass authentication by sending empty username and password parameters to the login endpoint, resulting in unauthorized access to user accounts, including administrative accounts.README.md:13README.md:25-27
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Vulnerability Documentation
CVE-2025-60375The file is a human-readable advisory describing an authentication bypass in Perfex CRM. It includes reproduction steps that involve manipulating HTTP requests, which is normal exploit documentation for this class of vulnerability.README.md:1-52
Review boundaries

What the analysis did not establish

  • The evidence packet contains only a single README.md file. No exploit or scanner code is present in the repository snapshot.
  • Only the README.md file was reviewed; no other files exist in the repository snapshot.
  • The review does not assess the validity or safety of the described vulnerability or its reproduction steps against a live system.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

2