Perfex CRM: Unauthenticated RCE via PHP's S: deserialization format

This was one of my most frustrating disclosures, feedback on the process is very welcome :)