This vulnerability affects PHPGurukul Small CRM 4.0 and is caused by unsafe deserialization in the /crm/login.php file's Login Success Handler component. The issue stems from the unserialize function processing the geopluginURL argument, allowing an attacker to craft malicious input that triggers deserialization. The attack can be initiated remotely but requires high complexity and is difficult to exploit. The CVSS 4.0 base score is 6.3, reflecting medium severity. Public exploit code exists, but no confirmed in-the-wild exploitation has been observed.

Successful exploitation could allow an attacker to execute arbitrary code or cause unexpected behavior due to unsafe deserialization. However, the attack complexity is high, and exploitability is difficult, which limits the likelihood of widespread exploitation. No privileges or user interaction are required, and the vulnerability does not affect confidentiality, integrity, or availability directly according to the CVSS vector.

No official patch or remediation has been provided or confirmed. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling or restricting access to the vulnerable component if possible and monitor for updates from PHPGurukul.