Preliminary research

Perfex CRM unauthenticated RCE via insecure deserialization

_NULL · NULL CATHEDRAL · 16 March 2026

AI-collected research leads through 2 October 2026, including bounded month-by-month reviews of selected social and community sources from March through September. Unranked, incomplete, not community-vetted, and subject to change.

Shows that printable PHP S-format serialization escapes pass Perfex CRM's input filtering while reconstructing private-property null bytes and PHP tags. A Guzzle FileCookieJar gadget then turns the surviving object injection into an unauthenticated file write and code execution chain.

Record

Researcher

_NULL

Published by

NULL CATHEDRAL

Date

16 March 2026

In the archive

• Collected in the 2026 preliminary research sweep

Tags

• php
• deserialization
• filter-bypass
• object-injection
• file-write
• rce
• owasp-a05-2021
• owasp-a08-2021

This page is the archive's own catalogue record. The research is the work of _NULL, first published at the original source. Preserved copies are kept so the citation survives its host.