This vulnerability affects the function AbstractKanban::applySortQuery in the file application/services/AbstractKanban.php of the Admin Kanban Endpoint component in CodeCanyon Perfex CRM versions 3.4.0 and 3.4.1. The issue arises from improper handling of an argument, enabling an attacker to inject SQL commands remotely. The CVSS 4.0 base score is 5.3 (medium), indicating a network attack vector with low complexity and no user interaction required. No vendor advisory or patch information is provided, and the vulnerability state is published with exploit code available.

Successful exploitation allows remote attackers to execute arbitrary SQL commands on the affected database, potentially leading to unauthorized data access or modification. The impact is rated medium severity with limited scope and impact metrics, reflecting partial confidentiality, integrity, and availability impacts. There are no confirmed reports of exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the affected Admin Kanban Endpoint and monitor for suspicious activity related to SQL injection attempts. Avoid exposing the vulnerable interface to untrusted networks where possible.