CVE-2021-48008
HighCVSS 7.5Summary
Chanjet CRM contains an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by manipulating the site_id GET parameter in the webservice endpoint. Attackers can exploit the lack of input sanitization through UNION-based injection to extract sensitive data from the database.
Risk Assessment
An attacker could access sensitive database data, potentially leading to confidentiality and integrity breaches.
Recommendation
Apply vendor patches and implement parameterized SQL queries and input validation.
Other vulnerabilities in Chanjet CRM
See all- CVE-2026-84111High
A vulnerability in Chanjet CRM up to version 20260707 affects the file jxf_dump_table.php. Manipulation of the gblOrgID argument causes SQL injection. The attack can be performed remotely, and the exploit has been published. The vendor did not respond to the disclosure.
- CVE-2026-11456High
A SQL injection vulnerability was found in Chanjet CRM 1.0 in the file /tools/jxf_dump_systable.php via the gblOrgID argument in the HTTP GET Request Handler component. The attack can be performed remotely and the exploit is publicly available. The vendor did not respond.
Original NVD description (English source)
Chanjet CRM contains an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by manipulating the site_id GET parameter in the webservice endpoint. Attackers can exploit the lack of input sanitization or parameterization through UNION-based injection techniques to extract sensitive data from the underlying database. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18.