CVE-2026-7783

Vulnerability

A blind time-based SQL injection vulnerability exists in CodeCanyon Perfex CRM up to version 3.4.1. The flaw resides in the AbstractKanban::applySortQuery method within application/services/AbstractKanban.php. The method directly concatenates user-supplied sort_by and sort_direction parameters into an ORDER BY clause with CodeIgniter's query-builder escape flag disabled (false), allowing arbitrary SQL subqueries to be injected [1].

##

Exploitation requires any authenticated staff account — no administrative privileges or specific role permissions are needed. The attack is performed remotely via several kanban endpoints such as admin/leads/leads_kanban_load_more, admin/proposals/proposals_pipeline_load_more, admin/estimates/estimates_pipeline_load_more, and admin/tasks/tasks_kanban_load_more. The attacker injects a SELECT ... SLEEP(...) subquery into the sort_by parameter, enabling time-based blind extraction of data one byte at a time [1].

##

##

Successful exploitation allows an attacker to read the entire application database, including the tblstaff.password column containing phpass hashes. With these hashes, an attacker can perform offline cracking to obtain the plaintext password of an administrator account, leading to full administrative control of the CRM instance [1].

##

The vendor has not released a patch as of the publication date. The recommended fix is to whitelist allowed sortable columns in AbstractKanban::applySortQuery to prevent injection. The exploit has been publicly disclosed and may be actively used [1].